Repository navigation

Security harden webhooks, HTTP secrets, and cron shell jobs - #907

Merged

DonPrus merged 28 commits into

nullclaw:mainfrom

racribeiro:main

May 28, 2026

Commits on May 10, 2026

security: keep API credentials out of curl argv
racribeiro
committed
c94e03f
security: require explicit inbound channel trust
racribeiro
committed
b9e2108
security: enforce shell policy for cron jobs
racribeiro
committed
cf7437b
chore: add local Docker build workflow
racribeiro
committed
081c0c2
docs: document security patch scope
racribeiro
committed
1acb34b
chore: default local gateway port to 3210
racribeiro
committed
fc4c0d1
chore: publish local gateway on host interfaces
racribeiro
committed
a3583f1
chore: run config before local gateway start
racribeiro
committed
dd32159
chore: use IPv4 loopback for gateway healthcheck
racribeiro
committed
367d574
docs: describe compose gateway workflow
racribeiro
committed
e0054f4
chore: bind local workspace into compose services
racribeiro
committed
6245d48
chore: add compose agent and status targets
racribeiro
committed
c8b4563
chore: keep compose up from rerunning config
racribeiro
committed
64369a6
chore: include git and shell env in runtime image
racribeiro
committed
c21c41d
chore: remove stale Docker expose port
racribeiro
committed
908e163
chore: bind compose config file from checkout
racribeiro
committed
464a133
chore: make down include compose profiles
racribeiro
committed
94808ca
chore: mount docker socket for sandbox runtime
racribeiro
committed
62f6a48
chore: add docker and make to runtime image
racribeiro
committed
8924ad4
chore: grant sandbox access to docker socket
racribeiro
committed
e53db58
chore: expand shell sandbox command set
racribeiro
committed
461f777

Commits on May 28, 2026

Merge remote-tracking branch 'origin/main' into review-pr-907
DonPrus
committed
cd9be80
fix: complete PR 907 security hardening
DonPrus
committed
c557248
fix: harden curl header temp files
DonPrus
committed
53bfcc0
fix: redact verbose SSE payload logs
DonPrus
committed
944d596
fix: harden compose init configuration
DonPrus
committed
97966e9
test: cover credentialed legacy curl fallbacks
DonPrus
committed
0eaa762
fix: preserve curl resolve pinning for credentials
DonPrus
committed
2765c28

Navigation Menu

Repository navigation

Security harden webhooks, HTTP secrets, and cron shell jobs - #907

Security harden webhooks, HTTP secrets, and cron shell jobs#907
DonPrus merged 28 commits into
nullclaw:mainfrom
racribeiro:main

Commits on May 10, 2026

security: keep API credentials out of curl argv

security: require explicit inbound channel trust

security: enforce shell policy for cron jobs

chore: add local Docker build workflow

docs: document security patch scope

chore: default local gateway port to 3210

chore: publish local gateway on host interfaces

chore: run config before local gateway start

chore: use IPv4 loopback for gateway healthcheck

docs: describe compose gateway workflow

chore: bind local workspace into compose services

chore: add compose agent and status targets

chore: keep compose up from rerunning config

chore: include git and shell env in runtime image

chore: remove stale Docker expose port

chore: bind compose config file from checkout

chore: make down include compose profiles

chore: mount docker socket for sandbox runtime

chore: add docker and make to runtime image

chore: grant sandbox access to docker socket

chore: expand shell sandbox command set

Commits on May 28, 2026

Merge remote-tracking branch 'origin/main' into review-pr-907

fix: complete PR 907 security hardening

fix: harden curl header temp files

fix: redact verbose SSE payload logs

fix: harden compose init configuration

test: cover credentialed legacy curl fallbacks

fix: preserve curl resolve pinning for credentials