-
Add CSP violation reporting
-
Lower the browser upload cap to 2 GiB
-
server: adopt lint block, fix clippy, fmt
-
Add multipart blob sessions for SyncKit
-
server: route promote through multipart copy above 5 GiB
-
Bound scan CPU layers + advertise-refs by wall clock; scope project purchase lookup
-
server: attach per-IP rate limit to guest download route
-
Remediate audit Run 21 findings across server
-
Scope internal-API identity to a signed SSH-authenticated assertion
-
Type-seal project price writes and tighten money paths (ultra-fuzz Run 11 Payments)
-
Harden ClamAV to fail-closed; drop dead code; anti-spray rate-limit
-
perf: scan timeouts on both paths, supervise+lock monitor, background appeal fan-out
-
perf: set-based sync-log compaction, off-runtime quota walk, bounded scan lookups
-
Background Stripe fan-outs and close perf cliffs (ultra-fuzz Run 6 Performance)
-
Harden git SSH limits and expand YARA corpus (ultra-fuzz Run 6 Security)
-
synckit: move usage-warning sends off the scheduler tick onto the bounded pool (ultra-fuzz Run 3 CHRONIC)
-
Sweep Run #22 minors: media presign tier cap, bounded scheduler spawns, session cap
-
Add git personal-access-tokens for HTTPS clone and push
-
Cap git upload-pack child lifetime to bound permit starvation
-
Stream git clone packfile and gate clone concurrency
-
OAuth maturation + HMAC method+path+nonce (close MT S13)
-
server: fold in outstanding working-tree changes
-
Run #14 remediation: governor sweeper, scan/storage/payments hardening
-
server: gallery/carousel, promo-validator, fuzz #11/#12 remediations, embed port, observability
-
launch-eve audit pass: Ultra Fuzz Runs #8-9 + cross-cutting sweeps
-
server: scan-spool orphan reaper + systemd StateDirectory
-
server: introduce scanning::spool module and spool constants
-
server: bound broadcast fan-out at 16 with 100ms cadence
-
server: hourly retention sweep on scan_jobs
-
server: rewrite scan pipeline (async + dashboard + 5 new layers)