Skip to content

Navigation Menu

Appearance settings

- AI CODE CREATION
  GitHub CopilotWrite better code with AI
  GitHub Copilot appDirect agents from issue to merge
  MCP Registry^NewIntegrate external tools
- DEVELOPER WORKFLOWS
  ActionsAutomate any workflow
  CodespacesInstant dev environments
  IssuesPlan and track work
  Code ReviewManage code changes
- APPLICATION SECURITY
  GitHub Advanced SecurityFind and fix vulnerabilities
  Code securitySecure your code as you build
  Secret protectionStop leaks before they start
- EXPLORE
  Why GitHub
  Documentation
  Blog
  Changelog
  Marketplace
View all features
- BY COMPANY SIZE
  Enterprises
  Small and medium teams
  Startups
  Nonprofits
- BY USE CASE
  App Modernization
  DevSecOps
  DevOps
  CI/CD
  View all use cases
- BY INDUSTRY
  Healthcare
  Financial services
  Manufacturing
  Government
  View all industries
View all solutions
- EXPLORE BY TOPIC
  AI
  Software Development
  DevOps
  Security
  View all topics
- EXPLORE BY TYPE
  Customer stories
  Events & webinars
  Ebooks & reports
  Business insights
  GitHub Skills
- SUPPORT & SERVICES
  Documentation
  Customer support
  Community forum
  Trust center
  Partners
View all resources
- COMMUNITY
  GitHub SponsorsFund open source developers
- PROGRAMS
  Security Lab
  Maintainer Community
  Accelerator
  GitHub Stars
  Archive Program
- REPOSITORIES
  Topics
  Trending
  Collections
- ENTERPRISE SOLUTIONS
  Enterprise platformAI-powered developer platform
- AVAILABLE ADD-ONS
  GitHub Advanced SecurityEnterprise-grade security features
  Copilot for BusinessEnterprise-grade AI features
  Premium SupportEnterprise-grade 24/7 support
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

muchiny / bridge-mcp Public

Notifications You must be signed in to change notification settings
Fork 3
Star 3

Code
Issues
Pull requests 3
Actions
Projects
Security and quality
Insights

Additional navigation options

Code
Issues
Pull requests
Actions
Projects
Security and quality
Insights

release: v1.17.0 — security audit 2026-05-09 (30+ FIND remediated)#48

Merged

muchiny merged 87 commits into

mainmuchiny/bridge-mcp:mainfrom

security/audit-2026-05-09muchiny/bridge-mcp:security/audit-2026-05-09Copy head branch name to clipboard

May 9, 2026

Conversation Commits87 (87)Checks Files changed

Merged

release: v1.17.0 — security audit 2026-05-09 (30+ FIND remediated)#48
muchiny merged 87 commits into
mainfrom
security/audit-2026-05-09

Commits

Commits on May 9, 2026

docs: implementation plan for 2026-05-09 security audit

muchiny
and
claude
committed
fix(security): validate firewall protocol against allowlist

muchiny
and
claude
committed
fix(security): allowlist systemd unit_type in list_command

muchiny
and
claude
committed
fix(security): validate env var names in file_template builder

muchiny
and
claude
committed
fix(security): RFC 4515-escape values in LDAP filters

muchiny
and
claude
committed
fix(security): randomize heredoc terminator in template_apply

muchiny
and
claude
committed
fix(security): sanitize commands before audit log write

muchiny
and
claude
committed
fix(security): canonicalize paths in validate_root_scope (Vuln 11)

muchiny
and
claude
committed
fix(security): HTTP transport defaults to loopback; refuse anonymous public bind

muchiny
and
claude
committed
fix(security): verify JWT signatures via jsonwebtoken (Vuln 2)

muchiny
and
claude
committed
fix(security): unguessable UUID-based PendingRequests ids (Vuln 8 part 1)

muchiny
and
claude
committed
fix(security): per-session PendingRequests (Vuln 8 part 2)

muchiny
and
claude
committed
fix(security): per-session SessionCapabilities (Vuln 9)

muchiny
and
claude
committed
fix(security): normalize ${IFS}/$'\t'/line-continuation before blacklist match

muchiny
and
claude
committed
style: rustfmt cleanup across security audit branch

muchiny
and
claude
committed
audit(2026-05-09): scaffold workspace and install plugin set

muchiny
and
claude
committed
audit(2026-05-09): capture pre-audit baseline snapshots
muchiny
committed
audit(2026-05-09): capture dependency-health baseline

muchiny
and
claude
committed
audit(2026-05-09): pull upstream security guidance via context7 MCP
muchiny
committed
audit(2026-05-09): re-run cargo geiger + udeps with real output
muchiny
committed
audit(2026-05-09): cache audit-context-building summary
muchiny
committed
audit(2026-05-09): map 358 MCP tool entry points with risk scores
muchiny
committed
audit(2026-05-09): inventory security and credential touchpoints
muchiny
committed
audit(2026-05-09): static-analysis on security/ssh/mcp modules
muchiny
committed
docs(audit-2026-05-09): seed findings tracker with Tasks 1-8 results
muchiny
committed
audit(2026-05-09): insecure-defaults review on config + ssh
muchiny
committed
audit(2026-05-09): supply-chain risk audit on Cargo deps
muchiny
committed
audit(2026-05-09): zeroize audit on cred-bearing modules
muchiny
committed
audit(2026-05-09): semgrep rules for top finding patterns
muchiny
committed
audit(2026-05-09): variant analysis on Vuln 8/9 cross-session pattern
muchiny
committed
audit(2026-05-09): proptest cases for validator/sanitizer/runbook
muchiny
committed
audit(2026-05-09): mutation testing on src/security/ (skipped per user)
muchiny
committed
fix(security): enforce saphyr Budget on all YAML parse sites (FIND-001/002/004/032)

muchiny
and
claude
committed
docs(audit): mark FIND-001/002/003/004/032 as fixed (2d213fb)

muchiny
and
claude
committed
refactor(domain): move yaml helper to domain layer (hexagonal compliance)
muchiny
committed
fix(security): add timeout/body-limit/request-id/sensitive-headers middleware (FIND-005)

muchiny
and
claude
committed
docs(audit): mark FIND-005 as fixed (9747fa6)

muchiny
and
claude
committed
fix(security): per-session active_requests map (FIND-038)

muchiny
and
claude
committed
docs(audit): mark FIND-038 as fixed (d031988)

muchiny
and
claude
committed
fix(security): load OAuth keys at boot, share Arc<OAuthValidator> (FIND-006)

muchiny
and
claude
committed
docs(audit): mark FIND-006 as fixed (0864649)

muchiny
and
claude
committed
fix(security): require sub/iss/aud spec claims on JWT (FIND-007)
muchiny
committed
docs(audit): mark FIND-007 as fixed (ebabff0)
muchiny
committed
fix(security): pin russh Preferred algos + rekey limits (FIND-008)
muchiny
committed
docs(audit): mark FIND-008 fixed (d8507dd)
muchiny
committed
fix(security)!: flip require_elicitation_on_destructive default to true (FIND-022)

muchiny
and
claude
committed
docs(audit-2026-05-09): record FIND-022 fix sha (ba8ce36)

muchiny
and
claude
committed
fix(security): Zeroizing<String> on HostConfig.sudo_password (FIND-028)
muchiny
committed
audit(2026-05-09): pin FIND-028 status to commit d025e90
muchiny
committed
fix(security): Zeroizing<String> on db_password Args (FIND-029)

muchiny
and
claude
committed
audit(2026-05-09): pin FIND-029 status to commit e76aeea

muchiny
and
claude
committed
fix(security): per-session runtime/notification/resource_subs/roots (FIND-033/034/036/037)

muchiny
and
claude
committed
audit(2026-05-09): pin FIND-033/034/036/037 status to commit d42161f

muchiny
and
claude
committed
audit(2026-05-09): supply-chain monitoring for saphyr + tokio-socks (FIND-026/027)
muchiny
committed
fix(reliability): replace expect with ?/Err on Result-returning fns (FIND-010/011/012/013)

muchiny
and
claude
committed
audit(2026-05-09): pin FIND-010/011/012/013 status to commit a243d8b

muchiny
and
claude
committed
fix(security): Zeroizing<String> on SocksProxyConfig.password (FIND-014)
muchiny
committed
audit(2026-05-09): pin FIND-014 status to commit 11ddeb9
muchiny
committed
fix(security): sanitize SSH errors at all connect-phase sites (FIND-016)
muchiny
committed
audit(2026-05-09): pin FIND-016 status to commit 213f57c
muchiny
committed
fix(security): deny_unknown_fields on every config + runbook struct (FIND-017)

muchiny
and
claude
committed
audit(2026-05-09): pin FIND-017 status to commit f16b7ab

muchiny
and
claude
committed
fix(security): SshConfigDiscovery default off (FIND-023)
muchiny
committed
audit(2026-05-09): pin FIND-023 status to commit a455798
muchiny
committed
fix(security)!: default-disable tool groups, ship 8-group minimal profile (FIND-024)

muchiny
and
claude
committed
audit(2026-05-09): pin FIND-024 status to commit 601bf01

muchiny
and
claude
committed
fix(security): drop archived shellexpand, use dirs::home_dir (FIND-025)

muchiny
and
claude
committed
audit(2026-05-09): pin FIND-025 status to commit e60200c

muchiny
and
claude
committed
audit(2026-05-09): flip FIND-027 to monitoring (tokio-socks dep-watch)
muchiny
committed
fix(security): Zeroizing<String> on vault Args.data (FIND-030)
muchiny
committed
audit(2026-05-09): pin FIND-030 status to commit 3216e07
muchiny
committed
fix(security): pipe vault/db secrets via stdin/tempfile (FIND-031)

muchiny
and
claude
committed
audit(2026-05-09): pin FIND-031 status to commit 9d81e12

muchiny
and
claude
committed
fix(audit): clippy clean across workspace --all-targets --all-features (FIND-019/020)
muchiny
committed
audit(2026-05-09): pin FIND-019/020 status to commit 50942bb
muchiny
committed
fix(deps): patch winrm-rs to drop obsolete reqwest feature (FIND-018)
muchiny
committed
audit(2026-05-09): pin FIND-018 status to commit 35b0df7
muchiny
committed
fix(ci): cargo-geiger fallback + baseline (FIND-021)
muchiny
committed
audit(2026-05-09): pin FIND-021 status to commit 81206bd
muchiny
committed
fix(security): per-session log_level (FIND-035)
muchiny
committed
audit(2026-05-09): pin FIND-035 status to commit f35bc94
muchiny
committed
test(per_session_log_level): use Arc::ptr_eq instead of raw casts (clippy)
muchiny
committed
test: align integration tests with FIND-023/024 default flips
muchiny
committed
test(tool_filtering): drop unused HashMap import (clippy)
muchiny
committed
chore(audit): remove 2026-05-09 audit workspace post-merge

muchiny
and
claude
committed
chore(release): v1.17.0 — security audit 2026-05-09

muchiny
and
claude
committed
fix(ci): patch winrm-rs via git ref instead of local path (FIND-018)

muchiny
and
claude
committed

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.