admin/ruflo
1
0 Fork 0
mirror of https://github.com/ruvnet/ruflo.git synced 2026-10-23 03:47:00 +09:00
Code Issues Packages Projects Releases Wiki Activity
9,832 Commits 919 Branches 1,708 Tags
main
Commit Graph
3 Commits
Author SHA1 Message Date
Wu Shuwen ffda049359 docs: canonicalize contribution and security links (#3234) 2026-10-20 21:38:29 -04:00
rUv 35e094aa89 docs: update SECURITY.md contact email 
Co-Authored-By: claude-flow <ruv@ruv.net>
 2026-03-19 15:49:54 +00:00
rUv 75fe9f564f fix: address security audit findings from #1375 (#1383) 
1. SQL injection: Convert all 9 string-interpolated queries in
   memory-initializer.ts to parameterized queries (db.prepare/bind)
   Closes #1030

2. Preinstall hook: Remove no-op preinstall script and package.json entry
   that triggered supply chain concern

3. SECURITY.md: Add vulnerability disclosure policy with supported
   versions, reporting process, and safe harbor statement

4. SafeExecutor: Remove npx from default command allowlist to prevent
   arbitrary package execution via safe executor

5. Cleanup command: Add `cleanup` command for removing project artifacts
   (.claude/, .swarm/, data/, etc.) with --dry-run default and --force
   to execute. Addresses uninstall documentation gap

Published as v3.5.40. All fixes verified in Docker.

Closes #1375
 2026-03-19 11:25:54 -04:00