fix: close script injection paths and protect masked settings - #313

Merged

MrYuion merged 10 commits into

fix/security-hardening

Sep 30, 2026

Commits on Sep 30, 2026

fix(ui): escape user names in confirm modal and editor HTML

MrYuion
and
claude
committed
dc02c63
fix(app): drop unused x-api-key URL param handler

MrYuion
and
claude
committed
9abbb75
fix(ui): stop bypassing href sanitising for stored URIs

MrYuion
and
claude
committed
8adb6e3
fix(admin): sandbox signage plugin embed to an opaque origin

MrYuion
and
claude
committed
33b3e69
fix(ui): ignore hotkeys when unlisted modifiers are held

MrYuion
and
claude
committed
90e00d0
fix(ui): save only editable dirty settings levels

MrYuion
and
claude
committed
9b1e126
fix(ui): validate extension embed URLs and frame messages

MrYuion
and
claude
committed
e251603
fix(ui): require scheme:// form for driver and module URIs

MrYuion
and
claude
committed
a638c9b
fix(ui): scope hotkeys to the top dialog and ignore modifier order

MrYuion
and
claude
committed
8cf3db2
fix(ui): escape item names in search field options

MrYuion
and
claude
committed
a9a7fa7