Security fixes combined (#243-#252) — staging test#263

Open

jessie-coco wants to merge 11 commits intodevelopfrom

security-fixes-combined

Commits on Mar 9, 2026

fix: use json_each() to prevent SQL injection in getItemsByTag (#243)

boot-coco
and
claude
committed
fix: prevent auth token exposure via externally_connectable (#246)

boot-coco
and
claude
committed
fix: escape server data in side panel innerHTML to prevent XSS (#245)

boot-coco
and
claude
committed
fix: add app_id scope check to V1 API handlers (#244)

boot-coco
and
claude
committed
fix: add app_id scope check to V1 API handlers (#244)

boot-coco
and
claude
committed
fix: return 404 for deleted items in dispatch log endpoints (#248)

boot-coco
and
claude
committed
fix: add .dockerignore and non-root user to prevent secret leakage (#249)

boot-coco
and
claude
committed
fix: add per-discussion write lock to prevent concurrent write data loss (#250)

boot-coco
and
claude
committed
fix: add auth to adapters endpoint and encrypt endpoint configs (#251)

boot-coco
and
claude
committed
fix: dashboard XSS, credential masking, auth property names, URL parsing (#252)

boot-coco
and
claude
committed
Merge fix/243-sql-injection-tag-query into security-fixes-combined
Jessie
committed