[spark-compete wave 5] security cross-cut (stacked) - #885

Merged

vibeforge1111 merged 13 commits into

mainfrom

spark-compete/wave5-security-crosscut

Jun 26, 2026

Commits on Jun 24, 2026

fix(deps): override devalue to >=5.8.1 (DoS via sparse array)

authored and
Meta Alchemist
committed
97c93e4

Commits on Jun 25, 2026

fix(security): redact server paths and harden rate-limiter client key

authored and
Meta Alchemist
committed
496c603
fix(security): path-traversal + arbitrary-code-execution hardening

authored and
Meta Alchemist
committed
7d94eb8
fix(reliability): scheduler/runner/retry/sync robustness + event dedup

authored and
Meta Alchemist
committed
5816f80
fix(mission-control): lifecycle dedup durability, bounded maps, drop visibility

authored and
Meta Alchemist
committed
e32b320
fix(mission-control): cancel-after-sync guard + idempotent canvas-load relays

authored and
Meta Alchemist
committed
20f3694
fix(security): replace predictable IDs with crypto.randomUUID at write/ID sites

authored and
Meta Alchemist
committed
267d3e4
fix(observability): log previously-silent catch blocks in server modules

authored and
Meta Alchemist
committed
f1dfc22
fix(security): constant-time-equals length-independent timing on auth compares

claude
and
ifeoluwaaj
committed
5a34ebb
fix(security): restrict events API CORS to an allowlist (no origin reflection)

claude
and
yossweh
committed
0f24842

Commits on Jun 26, 2026

fix(security): scope PRD target-folder guard to the Spark workspace, not cwd; un-block python -m

authored and
Meta Alchemist
committed
9fd8962
test: align suite with wave5 security behavior changes

authored and
Meta Alchemist
committed
d0b08c5
Merge remote-tracking branch 'origin/main' into spark-compete/wave5-security-crosscut

Meta Alchemist
authored and
Meta Alchemist
committed
8b9d797