5 Commits

Author	SHA1	Message	Date
Mohamed Boudra	8a585e60f2	fix(security): shell injection, symlink escape, remove /pairing endpoint, harden defaults ... - Replace all execAsync shell-interpolated git calls with execFileAsync + array args in session.ts - Add symlink resolution in file-explorer resolveScopedPath to prevent workspace escape - Remove /pairing HTTP endpoint from server; desktop now uses `paseo daemon pair --json` via CLI - Disable MCP HTTP endpoint by default (opt-in via config) - Correct SECURITY.md: fix cipher name (XSalsa20-Poly1305), accurate replay resistance claims, add local daemon trust boundary docs	2026-04-02 23:58:38 +07:00
Mohamed Boudra	765a11c7ab	fix(metadata): update project contact email	2026-03-25 23:36:55 +07:00
Mohamed Boudra	5ac6c4a82c	docs: add SECURITY.md	2026-02-05 15:08:41 +07:00
Mohamed Boudra	41403df485	docs: add SECURITY.md	2026-02-05 15:04:32 +07:00
Mohamed Boudra	ef899717c8	docs: add SECURITY.md	2026-02-05 15:02:55 +07:00