fix(security): key per-IP rate limits on the proxy-written forwarded hop - #6171

Open

waleedlatif1 wants to merge 8 commits into

worktree-fix-xff-client-ip-spoofing

Commits on Aug 2, 2026

fix(security): key per-IP rate limits on the proxy-written forwarded hop
waleedlatif1
committed
fix(security): restore the X-Real-IP fallback for webhook allowlists
waleedlatif1
committed
chore(helm): bump chart to 1.4.1 for the AUTH_TRUSTED_PROXIES doc update
waleedlatif1
committed
fix(security): mask IPv6 rate-limit keys to the routed /64
waleedlatif1
committed
fix(security): stop believing forwarded headers when nothing appends them
waleedlatif1
committed
fix(security): apply the proxy-trust gate in the docs app too
waleedlatif1
committed
fix(security): derive Helm proxy trust from ingress.enabled, fail the password ceiling closed
waleedlatif1
committed
fix(helm): treat TRUST_PROXY_HEADERS as chart-computed on both deployments
waleedlatif1
committed