Juan DenisandTyler Boykin 9fb0a6cab5 fix(security): close git argument injection in repo_url/app_path/branch (GHSA-8vx6-432p-h62q) ...

An authenticated user of any role could inject arguments into git
subprocesses running as the backend user (root under systemd):

- repo_url was passed unvalidated to git ls-remote/clone, enabling the
  ext:: transport (host command execution on git < 2.52 defaults) and
  file:// local-repository disclosure (all git versions).
- app_path on POST /deploy/clone was passed without a '--' terminator,
  enabling --upload-pack=<cmd> option injection independent of git
  version and protocol.*.allow policy.
- branch flowed into 'git fetch origin <branch>' as an unterminated
  refspec.

Fix (new app/utils/git_security.py applied at every affected sink):

- repo_url scheme allowlist (https/http/git/ssh + scp-like SSH);
  rejects ext::/file://, local paths, leading '-', whitespace.
- '-c protocol.ext.allow=never -c protocol.file.allow=never' pinned on
  every remote-touching git call, plus a restrictive GIT_ALLOW_PROTOCOL
  in the subprocess environment.
- '--' positional terminator before URL/path/refspec arguments —
  co-load-bearing with protocol pinning, which alone does not stop
  option injection such as --upload-pack=<cmd>.
- branch/ref validation (leading '-', ref-format metacharacters) for
  clone --branch, fetch refspecs and stored deploy configs.
- POST /deploy/clone now confines app_path to the managed apps root,
  mirroring how /apps/from-repository derives it server-side.

Adds 31 regression tests; bumps version to 1.7.86.

Reported-by: CaptBoykin
Co-authored-by: Tyler Boykin <25166954+CaptBoykin@users.noreply.github.com>

2026-08-11 19:43:46 -04:00

..

dns

feat(cloudflare): restore Round 2 engine — DNSSEC, Origin CA, rules, activity (plan 42 ph2)

2026-07-09 05:02:54 -04:00

site_importers

fix(recovery): rebuild DNS cutover service+API and SSH site importer

2026-07-08 01:41:22 -04:00

yara_rules

feat(security): job-backed malware scans with a web-shell YARA pass

2026-07-03 15:21:23 -04:00

__init__.py

refactor(plugins): add WordPress bridge + flagship/multi-blueprint plumbing

2026-07-01 23:45:22 -04:00

advanced_ssl_service.py

feat(sites): wildcard HTTPS for managed subdomains

2026-06-15 00:52:30 -04:00

agent_fleet_service.py

Add agent fleet management, discovery & updates

2026-03-23 01:46:41 -04:00

agent_plugin_service.py

fix(plugins): make plugin/template features fail honestly, not silently (audit H2)

2026-06-12 18:35:35 -04:00

agent_registry.py

feat(servers): store the agent's self-reported footprint dirs

2026-07-02 22:36:34 -04:00

ai_service.py

perf(ai): keep Prompture out of the panel's boot path (-24 MB RSS)

2026-07-25 14:15:29 -04:00

ai_tool_registry.py

perf(ai): keep Prompture out of the panel's boot path (-24 MB RSS)

2026-07-25 14:15:29 -04:00

ai_tools_builtin.py

feat(ai): add core AI assistant primitive powered by Prompture

2026-06-01 02:39:05 -04:00

anomaly_detection_service.py

Implement security features: key rotation, IP allowlist, anomaly detection

2026-01-22 18:11:22 -05:00

api_analytics_service.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

api_key_service.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

app_port_service.py

feat(manifest): appliance-tier typed L4 ports + plan-time blockers rail (plan 35 ph1)

2026-07-09 02:57:23 -04:00

audit_service.py

feat(activity): audit feed filters by target_id

2026-08-09 13:53:59 -04:00

auth_throttle_service.py

feat(auth): per-IP login brute-force throttle

2026-07-18 00:59:19 -04:00

backup_alert_service.py

feat(backup): trust round 2 — restore drills, offsite/verify (plan 30)

2026-07-07 20:29:25 -04:00

backup_cost_service.py

feat(backups): backup protection backend — policy, scheduler, smart backups, API

2026-06-22 19:53:23 -04:00

backup_drill_service.py

feat(backups): dynamic target-provider registry

2026-08-05 01:18:11 -04:00

backup_kind_registry.py

security: hook seam lifecycle + registrant binding

2026-08-05 13:36:33 -04:00

backup_offsite_service.py

feat(backup): trust round 2 — restore drills, offsite/verify (plan 30)

2026-07-07 20:29:25 -04:00

backup_policy_service.py

feat(backups): dynamic target-provider registry

2026-08-05 01:18:11 -04:00

backup_service.py

feat(backups): backup protection backend — policy, scheduler, smart backups, API

2026-06-22 19:53:23 -04:00

backup_verify_service.py

fix(recovery): rebuild setup-health/reconcile + backup drill/verify services

2026-07-08 01:41:31 -04:00

bandwidth_service.py

feat(hosting): per-domain bandwidth accounting

2026-07-03 15:21:48 -04:00

bootstrap_service.py

feat(manifest): finish appliance volumes + one-shot bootstrap (plan 35 ph2)

2026-07-09 03:05:08 -04:00

bounce_service.py

feat(notifications): restore email-bounce webhook slice (plan 42 ph3)

2026-07-09 04:55:53 -04:00

build_service.py

feat: Phase 2 developer experience — build packs, config snapshots, catalog certification

2026-06-23 18:49:04 -04:00

buildpack_service.py

feat(manifest): network identity — fromServer, SERVER_PUBLIC_IP, shared net (plan 35 ph5)

2026-07-09 03:28:08 -04:00

cache_service.py

Add performance optimization: Redis caching and background jobs

2026-03-23 02:27:52 -04:00

capacity_service.py

feat(templates): tell people whether a template actually fits the server

2026-07-25 15:48:36 -04:00

cf_ops_change_service.py

feat(cloudflare): restore Round 2 engine — DNSSEC, Origin CA, rules, activity (plan 42 ph2)

2026-07-09 05:02:54 -04:00

chat_webhook_service.py

fix(recovery): rebuild authz-R2 policy + notification digests/chat webhooks

2026-07-08 01:41:43 -04:00

cli_api_client.py

harden: broaden insecure-secret detection, bind API to loopback, fix break-glass sub

2026-07-15 12:07:14 -04:00

cloudflare_ops_bridge.py

feat(extensions): Phase 5 — extract Cloudflare zone-ops into serverkit-cloudflare-ops

2026-07-02 01:04:03 -04:00

compose_env_service.py

fix(deployments): stop stuck 0% installs, deploy repo apps on create, unify install UX

2026-07-21 22:57:33 -04:00

configuration_service.py

feat: UX hardening for the new organization/proxy/snapshot surfaces

2026-06-23 21:15:16 -04:00

connection_registry.py

restore: remaining reconstructed July 5-7 changes (clean recovered files not attributable to one plan)

2026-07-07 20:29:31 -04:00

connection_string.py

Introduce sk1 connection string format and GUI plugin

2026-05-05 14:03:31 -04:00

container_registry_service.py

feat(connections): authenticate private container registry pulls

2026-07-01 01:35:44 -04:00

container_scale_service.py

feat(docker): horizontal auto-scaling (CPU thresholds, min/max, cooldown)

2026-06-19 10:13:50 -04:00

container_sleep_service.py

feat(docker): container auto-sleep (policy, manual sleep/wake, idle sweep)

2026-06-19 09:54:40 -04:00

container_status_service.py

feat: Phase 1 foundation — status aggregator, API scopes, onboarding, template magic vars

2026-06-23 18:23:47 -04:00

contribution_service.py

feat(sdk): a second widget surface — types users place, not just slots

2026-07-25 19:24:41 -04:00

cron_run_service.py

fix(recovery): restore models + migration chain 056-074, cron_run_service, rbac authz

2026-07-08 00:17:55 -04:00

cron_service.py

feat(cron): rebuild /cron on the Domains list pattern

2026-07-27 22:44:40 -04:00

dashboard_service.py

feat(dashboard): a real editor, and widgets that say what they are

2026-07-25 21:14:50 -04:00

database_engine_extension_service.py

feat(databases): engine extensions, without the silent failure

2026-07-25 23:44:34 -04:00

database_engine_service.py

feat(databases): install any engine, because an engine is just a template

2026-07-25 20:09:05 -04:00

database_service.py

feat(databases): engine extensions, without the silent failure

2026-07-25 23:44:34 -04:00

db_admin_sso_service.py

feat(databases): managed DB users and one-click Adminer SSO

2026-07-03 14:24:15 -04:00

db_config_tuner_service.py

feat(databases): curated engine config tuner

2026-07-03 14:24:03 -04:00

db_process_service.py

feat(databases): live processlist with kill in the explorer

2026-07-03 14:24:02 -04:00

db_sync_service.py

feat(wordpress): finish Phase-A glue — create hardening, real URLs, offsite snapshots, push-to-deploy, API keys

2026-05-31 22:39:57 -04:00

ddns_service.py

feat(dns): dynamic DNS — token-authenticated A/AAAA updates

2026-06-19 03:12:07 -04:00

demo_deploy_service.py

feat(deployments): simulated demo deploys through the real console pipeline

2026-07-23 16:58:46 -04:00

deploy_kind_registry.py

feat(plugins): let plugins own deployment-shaped work

2026-07-25 12:46:59 -04:00

deployment_job_service.py

fix(deploy): let a failed install be retried from the panel

2026-07-25 16:51:44 -04:00

deployment_runner.py

feat(deploy): batched RunLogStream seam + streaming compose + deploy socket channel

2026-07-22 16:36:58 -04:00

deployment_service.py

feat(services): first-class managed volumes for apps

2026-07-01 01:57:07 -04:00

discovery_service.py

Fleet monitor + security and agent hardening

2026-03-23 01:58:28 -04:00

dns_change_service.py

feat(dns): change log + admin notice on failure (Phase 2 backend)

2026-06-22 16:34:17 -04:00

dns_cutover_service.py

fix(dns-cutover): restore snapshot() staging + provider-named 501 (plan 42 D7/ph5)

2026-07-09 04:50:16 -04:00

dns_ownership_service.py

feat(dns): change log + admin notice on failure (Phase 2 backend)

2026-06-22 16:34:17 -04:00

dns_provider_service.py

feat(dns): change log + admin notice on failure (Phase 2 backend)

2026-06-22 16:34:17 -04:00

dns_zone_service.py

feat(domains): unify domains & DNS into one surface + admin-only Connections

2026-06-23 00:34:55 -04:00

docker_service.py

fix(docker): stop sending compose v1 a v2-only flag

2026-07-25 16:19:33 -04:00

doctor_check_registry.py

feat(plugins): let extensions contribute doctor checks

2026-07-25 13:56:09 -04:00

doctor_service.py

feat(setup): capacity-aware install profiles and resource advisory

2026-07-31 14:56:37 -04:00

domain_attach_service.py

feat(manifest): apply engine — resolve/plan/apply + core domain attach (Phase 2)

2026-07-04 01:28:16 -04:00

drift_service.py

feat(manifest): push re-sync, drift check family, events (Phase 4)

2026-07-04 01:39:53 -04:00

email_relay_service.py

refactor(unify): §6 Phase C6b — Postfix relay backed by EmailProviderConnection

2026-06-24 14:36:08 -04:00

env_reference_service.py

feat(manifest): network identity — fromServer, SERVER_PUBLIC_IP, shared net (plan 35 ph5)

2026-07-09 03:28:08 -04:00

env_service.py

feat(manifest): fromSecret/fromService/generate reference binders (Phase 3)

2026-07-04 01:34:54 -04:00

environment_docker_service.py

Add configurable dev paths and centralize path management

2026-01-28 21:12:55 -05:00

environment_domain_service.py

Normalize emails, add panel_origin & domain-aware URLs

2026-06-22 14:37:44 -04:00

environment_health_service.py

refactor(automations): retire Workflow Builder engine, port emitters (Phase 4 backend)

2026-07-11 22:15:10 -04:00

environment_pipeline_service.py

refactor(plugins): add WordPress bridge + flagship/multi-blueprint plumbing

2026-07-01 23:45:22 -04:00

event_service.py

security: hook seam lifecycle + registrant binding

2026-08-05 13:36:33 -04:00

extension_lifecycle.py

security: hook seam lifecycle + registrant binding

2026-08-05 13:36:33 -04:00

extension_migration.py

refactor(extensions): extract seven builtins to standalone repos

2026-07-20 01:16:16 -04:00

fail2ban_jail_service.py

refactor(security): generalize the Fail2ban jail engine beyond WordPress

2026-07-22 17:37:20 -04:00

file_integrity_service.py

feat(security): scoped file-integrity monitoring

2026-07-03 15:21:34 -04:00

file_service.py

fix(security): correct PROTECTED_ROOTS path math; tighten root matching

2026-08-02 18:56:33 -04:00

firewall_service.py

Use system utils for commands and services

2026-02-10 08:09:38 -05:00

fleet_doctor_service.py

feat(setup): capacity-aware install profiles and resource advisory

2026-07-31 14:56:37 -04:00

fleet_monitor_service.py

Fleet monitor + security and agent hardening

2026-03-23 01:58:28 -04:00

fleet_repair_service.py

fix(recovery): rebuild agent-fleet survey + fleet doctor/repair services

2026-07-08 01:41:13 -04:00

fleet_sweep.py

feat(agent): V2 capability pack — survey/doctor/fleet sweep+repair (plan 28)

2026-07-07 20:29:24 -04:00

git_deploy_service.py

fix(security): close git argument injection in repo_url/app_path/branch (GHSA-8vx6-432p-h62q)

2026-08-11 19:43:46 -04:00

git_service.py

fix(security): close git argument injection in repo_url/app_path/branch (GHSA-8vx6-432p-h62q)

2026-08-11 19:43:46 -04:00

gitea_api_service.py

Add git webhook and deployment management APIs

2026-01-21 21:31:57 -05:00

htaccess_converter.py

feat(hosting): .htaccess to nginx converter

2026-07-03 15:22:05 -04:00

image_scanner_service.py

feat(security): per-image CVE scanning (grype) and SBOM generation (syft)

2026-06-19 01:33:45 -04:00

image_update_service.py

feat(docker): image-digest update detection

2026-06-19 09:22:18 -04:00

install_profile_service.py

feat(setup): capacity-aware install profiles and resource advisory

2026-07-31 14:56:37 -04:00

invitation_service.py

Add invitations, email models, admin APIs

2026-03-04 02:34:49 -05:00

linked_panel_agent.py

fix(linked-panel): accept compose file path in project_path from remote runner

2026-07-22 00:48:13 -04:00

linked_panel_service.py

feat(servers): ServerKit-to-ServerKit peering — embedded agent mode

2026-07-22 00:35:33 -04:00

log_service.py

fix(files): address PR review — literal grep match, tail clamp, extend RBAC coverage

2026-07-26 16:25:12 -04:00

login_link_service.py

feat(auth): one-time login links and demo mode

2026-07-03 14:23:50 -04:00

malware_scan_service.py

feat(security): job-backed malware scans with a web-shell YARA pass

2026-07-03 15:21:23 -04:00

managed_database_service.py

feat(databases): track managed databases as first-class resources

2026-07-01 09:44:48 -04:00

managed_db_user_service.py

feat(databases): engine extensions, without the silent failure

2026-07-25 23:44:34 -04:00

manifest_apply_service.py

feat(manifest): dockerfilePath — build services from a repo Dockerfile

2026-07-10 01:13:14 -04:00

manifest_persistence_service.py

feat(manifest): persist manifest + seed env + health-check gate (Phase 1)

2026-07-04 01:16:29 -04:00

manifest_preview_service.py

feat(manifest): fleet targeting, manifest-powered previews, CLI verbs (Phase 5 backend)

2026-07-04 01:46:34 -04:00

manifest_scaffold_service.py

feat(manifest): dockerfilePath — build services from a repo Dockerfile

2026-07-10 01:13:14 -04:00

manifest_spec_service.py

feat(manifest): dockerfilePath — build services from a repo Dockerfile

2026-07-10 01:13:14 -04:00

manifest_sync_service.py

feat(manifest): push re-sync, drift check family, events (Phase 4)

2026-07-04 01:39:53 -04:00

member_action_service.py

feat(security): authz hardening round 2 (plan 29)

2026-07-07 20:29:24 -04:00

metadata_guard_service.py

feat(security): cloud-metadata egress guard for app containers

2026-07-03 14:23:11 -04:00

metrics_history_service.py

fix(recovery): restore agent scopes, DNS preflight, catalog events, thread guards

2026-07-08 02:06:01 -04:00

migration_service.py

fix(migrate): stop burying Continue under every migration ever written

2026-07-25 20:33:34 -04:00

module_service.py

feat(extensions): Phase 5 — extract WordPress into serverkit-wordpress (backend)

2026-07-02 00:15:10 -04:00

monitor_service.py

feat(monitors): gate wordpress_site_id binding on WP presence

2026-08-05 01:18:23 -04:00

monitoring_service.py

refactor(automations): retire Workflow Builder engine, port emitters (Phase 4 backend)

2026-07-11 22:15:10 -04:00

nginx_advanced_service.py

Add Nginx advanced config: reverse proxy, load balancing, caching

2026-03-23 02:19:33 -04:00

nginx_service.py

feat(ops): config drift detection, per-resource repair and doctor sweep

2026-07-03 15:21:09 -04:00

nonce_service.py

Implement security features: key rotation, IP allowlist, anomaly detection

2026-01-22 18:11:22 -05:00

notification_service.py

feat(notifications): queue-backed Notification Bus + email system

2026-06-21 19:57:02 -04:00

openapi_service.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

pairing_service.py

fix(pairing): verify Ed25519 proof-of-possession on pairing poll

2026-05-31 16:08:32 -04:00

passkey_service.py

feat(auth): WebAuthn / Passkey support

2026-06-19 01:33:45 -04:00

permission_service.py

Add invitations, email models, admin APIs

2026-03-04 02:34:49 -05:00

php_service.py

Add log fallbacks, privilege helpers, and checks

2026-03-04 00:02:52 -05:00

plugin_service.py

security: signature lifecycle, update-path consent gates, download hardening

2026-08-05 13:36:20 -04:00

postfix_service.py

fix(security): prevent command injection via hostname in Postfix install (GHSA-mc93-rc3x-fpgq)

2026-07-26 15:19:08 -04:00

preview_service.py

feat(manifest): fleet targeting, manifest-powered previews, CLI verbs (Phase 5 backend)

2026-07-04 01:46:34 -04:00

private_url_service.py

feat(phase5): add PrivateURLService for slug generation

2026-01-19 02:35:18 -05:00

process_service.py

feat(services): support manual/local apps and zip uploads

2026-06-18 22:16:00 -04:00

project_service.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

proxy_stack_service.py

feat: UX hardening for the new organization/proxy/snapshot surfaces

2026-06-23 21:15:16 -04:00

python_service.py

Normalize emails, add panel_origin & domain-aware URLs

2026-06-22 14:37:44 -04:00

registrar_service.py

Polish connections: domain-expiry alerts, S3 image preview, encryption-health banner

2026-06-15 19:43:00 -04:00

registry_service.py

security: signature lifecycle, update-path consent gates, download hardening

2026-08-05 13:36:20 -04:00

remote_cloudflared_service.py

Add panel-driven cloudflared login flow

2026-05-01 05:52:11 -04:00

remote_cron_service.py

fix(recovery): restore lost cron-completion service methods (plan 34)

2026-07-08 02:05:39 -04:00

remote_docker_service.py

feat(services): port the deploy/services/templates design

2026-07-25 04:40:10 -04:00

remote_file_service.py

Add agent Phase4 primitives, remote files & UI

2026-05-01 03:37:33 -04:00

remote_packages_service.py

Add remote packages, services, sudo, job streaming and capability re-probe

2026-05-01 04:33:08 -04:00

remote_runtimes_service.py

Add Packages/Services tabs, JobProgressModal, pyenv runtime mgmt and template library

2026-05-01 04:42:30 -04:00

remote_systemd_service.py

Add remote packages, services, sudo, job streaming and capability re-probe

2026-05-01 04:33:08 -04:00

repository_manifest_service.py

feat(templates): deploy templates as a backend repo-kind catalog entry

2026-07-10 02:38:46 -04:00

resource_grant_service.py

fix(recovery): rebuild authz-R2 policy + notification digests/chat webhooks

2026-07-08 01:41:43 -04:00

resource_tier_service.py

feat(setup): capacity-aware install profiles and resource advisory

2026-07-31 14:56:37 -04:00

run_log_service.py

feat(wordpress): run environment promotions as watchable deployments

2026-07-25 13:29:12 -04:00

saved_view_service.py

feat(views): per-user saved table views API

2026-08-09 02:32:55 -04:00

search_provider_registry.py

feat(plugins): let extensions put their objects in global search

2026-07-25 13:40:00 -04:00

search_service.py

feat(plugins): let extensions put their objects in global search

2026-07-25 13:40:00 -04:00

secret_vault_service.py

refactor(services): centralize slug generation on app.utils.slug

2026-06-20 22:43:38 -04:00

security_feed_service.py

feat(security): daily GHSA feed check with admin notifications

2026-08-02 18:35:25 -04:00

security_policy_service.py

fix(recovery): rebuild authz-R2 policy + notification digests/chat webhooks

2026-07-08 01:41:43 -04:00

security_service.py

feat(security): job-backed malware scans with a web-shell YARA pass

2026-07-03 15:21:23 -04:00

server_metrics_service.py

Add server historical metrics API and service

2026-01-22 08:51:31 -05:00

server_onboarding_service.py

feat: Phase 4 polish & fleet — onboarding completion, fleet proxy, shared-resource depth, docs

2026-06-23 20:04:04 -04:00

server_template_service.py

fix(plugins): make plugin/template features fail honestly, not silently (audit H2)

2026-06-12 18:35:35 -04:00

settings_service.py

Marketplace trust: split 409 reasons, hide unreviewed outside dev mode

2026-07-22 23:18:33 -04:00

setup_health_service.py

fix(recovery): rebuild setup-health/reconcile + backup drill/verify services

2026-07-08 01:41:31 -04:00

setup_reconcile_service.py

fix(recovery): rebuild setup-health/reconcile + backup drill/verify services

2026-07-08 01:41:31 -04:00

shared_resource_service.py

feat: per-service targeting for the compose env overlay

2026-06-23 23:19:41 -04:00

signing_service.py

feat(extensions): ed25519 signing service + publisher key registry

2026-08-04 23:34:02 -04:00

site_base_domain_service.py

feat(sites): base-domain registry so sites can publish under multiple domains

2026-07-01 00:07:00 -04:00

site_domain_service.py

fix(recovery): restore agent scopes, DNS preflight, catalog events, thread guards

2026-07-08 02:06:01 -04:00

site_import_service.py

fix(recovery): rebuild DNS cutover service+API and SSH site importer

2026-07-08 01:41:22 -04:00

sites_https_service.py

feat(sites): per-base wildcard HTTPS + base-domain registry API

2026-07-01 00:11:18 -04:00

source_connection_service.py

feat(connections): one-click GitHub setup via the GitHub App manifest flow

2026-07-10 23:06:09 -04:00

speed_test_service.py

feat(monitoring): on-demand server speed test card

2026-07-03 14:23:29 -04:00

ssl_service.py

feat(cloudflare): restore Round 2 engine — DNSSEC, Origin CA, rules, activity (plan 42 ph2)

2026-07-09 05:02:54 -04:00

sso_service.py

Normalize emails, add panel_origin & domain-aware URLs

2026-06-22 14:37:44 -04:00

storage_provider_service.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

support_bundle_service.py

restore: remaining reconstructed July 5-7 changes (clean recovered files not attributable to one plan)

2026-07-07 20:29:31 -04:00

survey_service.py

fix(recovery): rebuild agent-fleet survey + fleet doctor/repair services

2026-07-08 01:41:13 -04:00

system_service.py

fix(system): report IANA timezone_id; guard chart formatting against bad zones

2026-07-01 22:55:11 -04:00

telemetry_service.py

Truncate large telemetry payloads & UI robustness fixes

2026-06-22 01:45:15 -04:00

template_service.py

perf(templates): cache parsed local templates on file mtime

2026-08-06 09:32:40 -04:00

terminal_service.py

Add full-stack remote terminal/PTY support

2026-01-22 16:44:06 -05:00

test_sandbox_service.py

Add test sandbox and harden install scripts

2026-07-20 22:26:19 -04:00

theme_registry_service.py

feat(themes): hardening — preview validation, registry caching, token wiring (plan 61)

2026-07-23 09:25:01 -04:00

theme_service.py

feat(themes): backend model, API, and registry pipeline (plan 60 Phase 2-3)

2026-07-23 00:24:00 -04:00

theme_tokens.py

feat(themes): hardening — preview validation, registry caching, token wiring (plan 61)

2026-07-23 09:25:01 -04:00

totp_service.py

Add two-factor authentication (2FA) support

2026-01-18 01:03:56 -05:00

unit_compose_service.py

feat(manifest): multi-container units (plan 35 ph3)

2026-07-09 03:13:54 -04:00

upload_service.py

refactor(services): centralize slug generation on app.utils.slug

2026-06-20 22:43:38 -04:00

uptime_service.py

Add server uptime tracking and visualization

2026-01-17 13:37:40 -05:00

volume_service.py

feat(manifest): finish appliance volumes + one-shot bootstrap (plan 35 ph2)

2026-07-09 03:05:08 -04:00

waf_service.py

feat(security): per-app WAF (ModSecurity v3 + OWASP CRS)

2026-06-19 14:02:24 -04:00

webhook_gateway_service.py

refactor(services): centralize slug generation on app.utils.slug

2026-06-20 22:43:38 -04:00

webhook_service.py

feat(manifest): push re-sync, drift check family, events (Phase 4)

2026-07-04 01:39:53 -04:00

wordpress_bridge.py

security: hook seam lifecycle + registrant binding

2026-08-05 13:36:33 -04:00

workspace_service.py

feat(workspaces): improve workspace switching and secrets/webhooks UI

2026-06-21 18:32:25 -04:00

yara_scan_service.py

feat(security): job-backed malware scans with a web-shell YARA pass

2026-07-03 15:21:23 -04:00