Security hardening: same-origin-only local API, 0600 settings, repo cleanup - #118
Draft
shellen wants to merge 1 commit into
Draft
Security hardening: same-origin-only local API, 0600 settings, repo cleanup#118shellen wants to merge 1 commit into
shellen wants to merge 1 commit into
Conversation
…leanup - Remove Access-Control-Allow-Origin: * from the viewer server. Every legitimate client (Tauri webview and browser UI) is served from 127.0.0.1:7777 itself, so the wildcard only ever served other websites' JavaScript — which could read the user's library, notes, and stored SMTP/LLM credentials, and write config, from any page open in a browser while Pull Read runs. Same-origin requests never consult CORS, so nothing legitimate changes. - Write settings.json (SMTP password, LLM API keys) with mode 0600 and chmod existing files down on the next write. - Untrack local agent/tool state (.claude/, .pongogo/, .superpowers/, .mcp.json) and gitignore it — local files kept, just not published. - Delete the wiki/ stub, generated email-header-b64.txt (email.ts uses the .png; regenerable via render-email-header.ts), and the completed human-needed.md checklist (RELEASING.md documents the secrets). - Move stale root plan docs into docs/plans/ with dated names. Source-shape tests lock in the no-CORS and 0600 invariants. CSP follow-up filed as #117. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AdXEsWQTadb9qbTQjLkMqn
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
From the August 2026 security sweep.
Access-Control-Allow-Origin: *from the local viewer server (src/viewer.ts). The API on 127.0.0.1:7777 serves the article library, notes, email settings (including the SMTP password), and LLM config. With the wildcard header, any website open in the user's browser could read and write all of it. Every legitimate client — the Tauri webview (commands.rsloadshttp://127.0.0.1:{port}) and the browser UI — is same-origin, and same-origin requests never consult CORS, so removing the header changes nothing for the app and only shuts out cross-origin (i.e. hostile) callers.settings.jsonwritten with mode 0600 (was world-readable 644) — it holds the SMTP password and any LLM API keys; existing files get chmod'd down on next write..claude/,.pongogo/,.superpowers/,.mcp.json(local files kept; gitignored so they never publish again), delete thewiki/stub + generatedemail-header-b64.txt+ completedhuman-needed.md, move two stale root plan docs intodocs/plans/.Note: the untracked folders remain in git history (contents reviewed — generic tool instructions and wireframes, no credentials); scrubbing history isn't worth breaking released tags.
Release-notes guidance: per rollout policy, describe this in public release notes only as "performance and security updates" — no exploit details.
Draft — hold for the next release train; do not merge this week.
🤖 Generated with Claude Code
https://claude.ai/code/session_01AdXEsWQTadb9qbTQjLkMqn