v2.17.1 — security hardening (draconian must-fix review)#321

Merged

fabriziosalmi merged 6 commits into

mainfrom

fix/draconian-hardening

Jun 16, 2026

Commits on Jun 16, 2026

fix(client-certs): reject path traversal via Common Name on issuance

fabriziosalmi
and
claude
committed
fix(backup): restore archived + ACME private keys as 0600, not 0644

fabriziosalmi
and
claude
committed
fix(settings): preserve masked webhook secrets on generic settings save

fabriziosalmi
and
claude
committed
fix(api): require viewer role on GET /api/metrics

fabriziosalmi
and
claude
committed
fix(auth): revoke live sessions when a user is disabled, demoted, or deleted

fabriziosalmi
and
claude
committed
chore(release): v2.17.1 — security hardening

fabriziosalmi
and
claude
committed