fix(security): harden findings — path traversal, SSRF, IDOR, file auth, credential access#4571

Merged

waleedlatif1 merged 17 commits into

fix/security-deepsec-findings

May 13, 2026

Commits on May 12, 2026

fix(security): harden HIGH deepsec findings across multiple attack surfaces
waleedlatif1
committed
fix(security): eliminate workspace env lost-update race with atomic JSONB ops
waleedlatif1
committed
fix(security): address audit findings from security fix review
waleedlatif1
committed
fix(security): address PR review comments and harden deepsec fixes
waleedlatif1
committed
fix(workflows): fix VariableType assignment in admin workflow import route
waleedlatif1
committed
fix(a2a): handle Request objects in pinnedFetch URL extraction
waleedlatif1
committed
fix(security): extract shared file-access guard; merge workspace/mothership branch
waleedlatif1
committed
fix(security): advisory lock for env first-insert race; handle all BodyInit types in pinnedFetch
waleedlatif1
committed
chore: remove inline comment from advisory lock
waleedlatif1
committed
fix(security): remove stray comment; narrow credentialType to literal union
waleedlatif1
committed
fix(security): add credentialId validation to wealthbox oauth route; fix null body override in pinnedFetch
waleedlatif1
committed
fix(security): stream A2A response body to unblock SSE; keep text/json/arrayBuffer for non-streaming callers
waleedlatif1
committed
fix(security): resolve credentialId guard on OneDrive, use assertToolFileAccess in WordPress, memoize body buffer to prevent silent empty reads, fix ArrayBuffer type cast
waleedlatif1
committed
fix(security): handle string[][] HeadersInit format in pinnedFetch
waleedlatif1
committed

Commits on May 13, 2026