fix(security): fix vulnerabilities from internal security audit#17

Open

Linhead wants to merge 14 commits into

devfrom

chore/several-updates

Commits on Apr 29, 2026

fix(security): add cors.originRegexps support and remove wildcard origin
Linhead
committed

Commits on Apr 30, 2026

Commits on May 1, 2026

chore(security): protect node topology endpoint with API key auth + changes in README
Linhead
committed
chore(security): add startup warning and readme notice for tls reverse proxy requirement
Linhead
committed
chore(security): disable x-powered-by header to prevent framework disclosure
Linhead
committed
chore(security): query blockstore filesystem for available storage size
Linhead
committed
chore(security): add pre-push hook to block push on high severity vulnerabilities
Linhead
committed
fix(utils): replace console.log with pino in file.ts
Linhead
committed
fix(semgrep): tighten multer-unsafe-originalname rule to target dangerous sinks
Linhead
committed