fix: security hardening from aardvark/codex scanner findings#352

Merged

johntmyers merged 13 commits intomainfrom

fix/l7-rest-parser-overread-smuggling

Mar 16, 2026

Commits on Mar 16, 2026

fix(sandbox): prevent overread request smuggling in L7 REST parser
johntmyers
committed
fix(server): harden sandbox TLS secret volume permissions to 0400
johntmyers
committed
fix(sandbox): stop using cmdline paths for binary policy matching
johntmyers
committed
fix(sandbox): reject symlink and non-dir read_write paths before chown
johntmyers
committed
fix(server): redact provider credentials in gRPC CRUD responses
johntmyers
committed
fix(sandbox): enforce non-root fallback when process user unset
johntmyers
committed
fix(sandbox): deny forward proxy for L7-configured endpoints
johntmyers
committed
test(e2e): add regression test for forward proxy L7 bypass
johntmyers
committed
fix: update tests for cmdline path and TLS volume changes
johntmyers
committed
test(e2e): update provider e2e tests for credential redaction
johntmyers
committed
chore: reformat for Rust 1.94 assert! macro style
johntmyers
committed
fix(sandbox): make drop_privileges tests root-aware for CI
johntmyers
committed
fix(sandbox): allow non-directory read_write entries like /dev/null
johntmyers
committed