Pre release security auditing#27

Merged

vagkaratzas merged 11 commits into

v3from

pre-release-security-auditing

Jul 8, 2026

Commits on Jul 8, 2026

audit report files
vagkaratzas
committed
Quadratic blow-up in clustered layout DoS attack fixed, added MAX_ALL_PAIRS_MEMBERS and one virtual hub fallback option
vagkaratzas
committed
fix: bound token-session storage to stop disk-fill DoS (H2)

vagkaratzas
and
claude
committed
fix: reject malformed TSV with 400 instead of crashing 500 (#1)

vagkaratzas
and
claude
committed
fix: reject non-object session list members with 400 (#2)

vagkaratzas
and
claude
committed
fix: sanitize edge weights to stop 500s and invalid-JSON output (#3, #4)

vagkaratzas
and
claude
committed
fix: escapeHtml also escapes the single quote (#5)

vagkaratzas
and
claude
committed
fix: escape channel color before interpolating into attribute value (#6)

vagkaratzas
and
claude
committed
fix: URL-encode external session token in request path (#7)

vagkaratzas
and
claude
committed
fix: rate-limit /api/ to blunt unauthenticated CPU-saturation (#8)

vagkaratzas
and
claude
committed
lint / format backend
vagkaratzas
committed