Arnaud 5a9e306357 fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit ...

Bump to 0.5.1. Fixes: unfollowed-redirect SSRF + DNS-rebinding in AI
url-import and webhook dispatch (new safeFetch with IP-pinned undici
dispatcher); cross-user photo deletion via unvalidated recipe/review
storage keys; comment-moderation and tier-quota checks trusting a
stale cached session role/tier instead of the DB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-12 19:05:20 +02:00

..

auth/[...all]

feat(auth): login, signup, email verification, Better Auth routes

2026-07-01 08:09:37 +02:00

docs

feat: misc — cooking mode, OpenAPI docs, email, storage, upload, homepage

2026-07-01 08:11:31 +02:00

internal/cron

feat: batch-cook shopping list (already worked) + leftover expiry reminders

2026-07-12 10:03:52 +02:00

v1

fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

2026-07-12 19:05:20 +02:00

webhooks/stripe

fix: audit fixes — tier-quota bypass, webhook SSRF, auth hardening, pagination, a11y

2026-07-09 21:50:35 +02:00