SnapOtter ace41168bc fix(security): harden API against pentest findings ...

- Default TRUST_PROXY=false to prevent XFF rate limit bypass (PT-01)
- Return 400 instead of 500 on malformed JSON input (PT-03)
- Default MAX_PIPELINE_STEPS=20 to prevent DoS (PT-04)
- Validate clientJobId length (max 128) across all routes (PT-06)
- Add security headers to all reply.hijack() streaming responses (PT-07)
- Sanitize usernames in audit log to prevent stored XSS (PT-08)
- Block TRACE method with 405 response (PT-10)
- Add 429 RateLimited response to OpenAPI spec (PT-12)
- Default MAX_SVG_SIZE_MB=50 to limit SVGZ decompression (PT-13)
- Pin Dockerfile base images by digest
- Sanitize OIDC IdP error and sub claim in audit log
- Sync Docker compose/Dockerfile defaults with env.ts

2026-06-07 21:54:27 +08:00

..

.dockerignore

fix: Docker hardening, security, and deployment readiness for V1 (#82)

2026-04-21 10:19:08 +08:00

docker-compose-gpu.yml

fix(security): harden API against pentest findings

2026-06-07 21:54:27 +08:00

docker-compose.test.yml

chore: deploy to Cloudflare Pages and update branding

2026-04-24 18:06:29 +08:00

docker-compose.yml

fix(security): harden API against pentest findings

2026-06-07 21:54:27 +08:00

Dockerfile

fix(security): harden API against pentest findings

2026-06-07 21:54:27 +08:00

Dockerfile.test

fix: build libheif 1.21.2 from source for iPhone HEIC support (#183) (#199)

2026-06-05 17:05:01 +08:00

Dockerfile.test.dockerignore

fix: resolve ONNX CUDA fallback, Docker e2e infrastructure, and all test failures

2026-04-20 20:53:54 +08:00

download_models.py

feat: add BiRefNet HR-matting model download and manifest entry

2026-05-05 22:56:31 +08:00

entrypoint.sh

feat: add Docker _FILE secret convention for sensitive env vars (#205)

2026-06-06 21:18:14 +08:00

feature-manifest.json

feat: pre-built release archives + AI install fixes (#202)

2026-06-05 18:42:30 +08:00