82eae7cFix profile photo clearing on absent field, remove dead code in padded_len, fix CI comment typoLancelot3 months ago 850d68dsecurity audit fixes: 35 findings across core, shell, server, specLancelot3 months ago ee54351Security audit 13th pass: fix 23 findings across crypto, server, clientLancelot3 months ago 3258116Security: add AAD to AEAD (v0x02), fix livelock, bound dedup, cap gossip amplificationiko3 months ago 11c24d8Security audit fixes: Q16 cursor poisoning, Q17 ack ordering, Q18 persistent seen_ids, Q25 malformed JSON, Q35 revokeOthers challenges, Q37 sig inside atomic, Q38 audit log, Q49 low-order X25519 check, spec gaps Q39-Q44, §10 risk table updatesLancelot3 months ago da51700Security audit Q1-Q9: zstd window cap, poll event/body caps, cursor clamp, verify_strict, TEST-NET-2, cursor watchdog, cached X25519 keys, base64 photo validationLancelot3 months ago e57c03cEleventh-pass audit: add flush generation to prevent send-loop forkLancelot3 months ago 660cb44Tenth-pass audit: AddContact clears stale error on retryLancelot3 months ago 492430cNinth-pass audit: SetBlocked clears stale error on unblockiko3 months ago e894a24Eighth-pass audit: fix silent send/profile errors, draft loss on failed sendiko3 months ago c24f528Seventh-pass audit: zeroize encrypt inner on AEAD failure, fix stale commentsiko3 months ago 4e03722Sixth-pass audit: send-side body/profile/nickname length checks, zeroize Decrypted plaintext, send watchdogiko3 months ago f34323cFifth-pass audit: fix send_text contact-cap ordering, spec version-byte omissions, zstd level, DeleteContact UI, comment mismatchiko3 months ago 92e93f0Fourth-pass audit: zeroize decrypt intermediates, fix dead poll loop, clamp ts lower bound, enforce MAX_CONTACTS in send_text, profile-before-text ordering, ack_ids post-filter count check, fix §4 Blocking speciko3 months ago b8d30b6Third-pass audit: fix cursor-loss, block-check, zeroization, spec driftiko3 months ago 3154319Second-pass audit: fix regressions from first passiko3 months ago f04d81bAudit: implement all 18 findings from protocol/codebase reviewiko3 months ago c28cf14Swift: disable HTTP redirect following; server/protocol: document timing side-channel and key rotation future extensioniko3 months ago aaf961acrypto: use is_multiple_of in the padding-bucket assertioniko3 months ago 9efb186core: bound the outbox, batch its sends, and add DeleteContactiko3 months ago 540f20cphonemic: use HashMap lookup for @p syllable decode (O(1) vs O(256))iko3 months ago b0ffcd8Add length padding to encrypted blobsiko3 months ago c89ed87server.knot: fix orphaned forwards bug + 10 simplificationsiko3 months ago e4eeb27server.knot: fix 4 bugs + 22 simplifications from auditiko3 months ago 8d304b5server.knot: remove duplicate pruneExpired block commentiko3 months ago 9118bb4server.knot: saturate decimalValueGo accumulator to prevent i64 overflow paniciko3 months ago