6 Commits

Author	SHA1	Message	Date
Mohamed Boudra	7a8f65805d	refactor: rename allowedHosts to hostnames (#413) ... * refactor: rename allowedHosts to hostnames for DNS rebinding config The old name confused users who thought it was related to CORS. "hostnames" communicates that you're declaring the daemon's own hostnames, not granting access to external parties. Backward compatible: old config files (daemon.allowedHosts), env var (PASEO_ALLOWED_HOSTS), CLI flag (--allowed-hosts), and Nix option (allowedHosts) all still work as deprecated aliases. * fix(nix): update npmDepsHash to match current package-lock.json	2026-04-15 12:47:49 +08:00
Mohamed Boudra	8a585e60f2	fix(security): shell injection, symlink escape, remove /pairing endpoint, harden defaults ... - Replace all execAsync shell-interpolated git calls with execFileAsync + array args in session.ts - Add symlink resolution in file-explorer resolveScopedPath to prevent workspace escape - Remove /pairing HTTP endpoint from server; desktop now uses `paseo daemon pair --json` via CLI - Disable MCP HTTP endpoint by default (opt-in via config) - Correct SECURITY.md: fix cipher name (XSalsa20-Poly1305), accurate replay resistance claims, add local daemon trust boundary docs	2026-04-02 23:58:38 +07:00
Mohamed Boudra	765a11c7ab	fix(metadata): update project contact email	2026-03-25 23:36:55 +07:00
Mohamed Boudra	5ac6c4a82c	docs: add SECURITY.md	2026-02-05 15:08:41 +07:00
Mohamed Boudra	41403df485	docs: add SECURITY.md	2026-02-05 15:04:32 +07:00
Mohamed Boudra	ef899717c8	docs: add SECURITY.md	2026-02-05 15:02:55 +07:00