boban
0 Followers · 0 Following
  • Joined on 2025-09-28
Repositories
12
 Projects Packages Public Activity Starred Repositories
Loading Heatmap…

boban pushed to feat/v1-foundation at boban/clusev

  • bf4366dfc9 harden(opsec): disguise honeypot action labels in the audit log

2026-07-05 19:00:11 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • 930f78efbd polish(ui): in-system design refinements from the design review

2026-07-05 18:06:46 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • 0943d56201 harden(update): verify the self-update commit signature before the root re-exec/build
  • 46924135e6 perf(fleet,wg) + i18n(dashboard,update) + a11y(btn): re-audit design/perf cleanups
  • 6927987a0d harden(fleet,infra): enforce credential revocation on the poller + prod container hardening
  • Compare 3 commits »

2026-07-05 17:10:36 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • bc2f2b527f fix(security): close file-read RBAC gap + fail2ban arg-injection + update/HMAC hardening

2026-07-05 16:05:44 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • c914790a46 harden honeypot/ban path: close evasions, unmask & audit-DoS vectors

2026-07-05 15:05:53 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • f804e25a66 refactor(release): single stable channel — cut internal release candidates (-rc), remove all beta wording

2026-07-05 13:18:42 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • e6f6e7f8a4 fix(dev): read VITE_HMR_HOST from the .env FILE (loadEnv), restoring dev HMR assets

2026-07-05 11:06:54 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • c63af35194 feat(honeypot): surface login attempts in the dashboard (threats KPI, tried-credentials, sidebar badge)

2026-07-05 10:56:45 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • 473fa8c0d0 feat(honeypot): trap fake-login submits + capture the attempted credentials

2026-07-05 10:34:07 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • 6c70d885f7 feat(honeypot): realistic styled decoy pages (WordPress, phpMyAdmin, generic login)

2026-07-05 10:19:38 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • 1b3e058de6 fix(honeypot): route non-existent .php probes through nginx to the trap

2026-07-05 09:32:23 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • 72de7b9a22 fix(rbac,honeypot): gate audit-retention + email sendTest; honeytoken scans JSON body
  • e602320c9d fix(rbac,honeypot): gate settings/release surfaces + per-install canaries, no reflected/auth-user honeypot bans
  • e58d1a4b07 feat(rbac): hide the system-update trigger behind manage-fleet too
  • 8b34ed8ef5 feat(rbac): hide gated controls in the UI with @can (operator/viewer see no dead buttons)
  • 4f9699d470 feat(honeypot): threats dashboard — probe feed, KPIs, banned-IP management
  • Compare 11 commits »

2026-07-05 02:32:26 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • 3c25f097fa fix(security): close the TOCTOU in the symlink-safe status write (Codex review)
  • a6176341e2 fix(security): keep internal IPs out of shipped code and docs/ out of the public image
  • d7156ddc96 fix(security): harden the update path — signed sentinel, symlink-safe root writes, .env 0600
  • Compare 3 commits »

2026-07-04 10:43:07 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • 8a814337ff fix(install): validate release-image digests as ghcr.io/<owner>/<name>@sha256:<64-hex>
  • 4af1633ca9 fix(install): harden release-image resolver — safe build fallback, ghcr digest allowlist, lint + CI coverage
  • ace3af5849 feat(install): pull promoted image on public installs via release-images.lock
  • a3cc563883 feat(install): resolve prod image from release-images.lock (pull vs build)
  • Compare 4 commits »

2026-07-03 21:47:38 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • 383f2fe74a feat(release): remove the no-op channel selector + dead beta→stable promotion (single stable channel)

2026-07-03 20:46:30 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • 10486672a5 ci: build+push prod images, gated auto-promote to public

2026-07-03 20:34:03 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • fff2d017be build: export-ignore the promote.sh test scripts too (they invoke the ignored script)
  • 4e4023f12d feat(release): collapse to a single stable channel
  • 176b132da9 chore(release): remove every 'gitea' reference from the public tree (comments, test fake-host, redundant ignore)
  • 54518c1f30 feat(release): string leak-guard in promote.sh + shell test
  • e02f4d036a build: export-ignore the full dev-release bridge + its tests from the public tree
  • Compare 5 commits »

2026-07-03 20:06:59 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • 72b82df7a1 fix(update): surface update failures instead of spinning forever

2026-07-03 18:58:34 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • 6348d269a5 docs: fix stale first-login copy (random initial password, rotation optional)

2026-07-02 22:50:37 +02:00

boban pushed to feat/v1-foundation at boban/clusev

  • d08a8a3866 docs: rename the generated password "one-time" → "initial" (rotation is optional)

2026-07-02 22:43:11 +02:00