Skip to content

Navigation Menu

Appearance settings

- AI CODE CREATION
  GitHub CopilotWrite better code with AI
  GitHub Copilot appDirect agents from issue to merge
  MCP Registry^NewIntegrate external tools
- DEVELOPER WORKFLOWS
  ActionsAutomate any workflow
  CodespacesInstant dev environments
  IssuesPlan and track work
  Code ReviewManage code changes
- APPLICATION SECURITY
  GitHub Advanced SecurityFind and fix vulnerabilities
  Code securitySecure your code as you build
  Secret protectionStop leaks before they start
- EXPLORE
  Why GitHub
  Documentation
  Blog
  Changelog
  Marketplace
View all features
- BY COMPANY SIZE
  Enterprises
  Small and medium teams
  Startups
  Nonprofits
- BY USE CASE
  App Modernization
  DevSecOps
  DevOps
  CI/CD
  View all use cases
- BY INDUSTRY
  Healthcare
  Financial services
  Manufacturing
  Government
  View all industries
View all solutions
- EXPLORE BY TOPIC
  AI
  Software Development
  DevOps
  Security
  View all topics
- EXPLORE BY TYPE
  Customer stories
  Events & webinars
  Ebooks & reports
  Business insights
  GitHub Skills
- SUPPORT & SERVICES
  Documentation
  Customer support
  Community forum
  Trust center
  Partners
View all resources
- COMMUNITY
  GitHub SponsorsFund open source developers
- PROGRAMS
  Security Lab
  Maintainer Community
  Accelerator
  GitHub Stars
  Archive Program
- REPOSITORIES
  Topics
  Trending
  Collections
- ENTERPRISE SOLUTIONS
  Enterprise platformAI-powered developer platform
- AVAILABLE ADD-ONS
  GitHub Advanced SecurityEnterprise-grade security features
  Copilot for BusinessEnterprise-grade AI features
  Premium SupportEnterprise-grade 24/7 support
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

aavion / studio Public

Notifications You must be signed in to change notification settings
Fork 0
Star 1

Code
Issues 21
Pull requests 2
Actions
Security and quality
Insights

Additional navigation options

Code
Issues
Pull requests
Actions
Security and quality
Insights

Feat security#102

Draft

dominikletica wants to merge 181 commits into

dev-latestaavion/studio:dev-latestfrom

feat-securityaavion/studio:feat-securityCopy head branch name to clipboard

Conversation Commits181 (181)Checks Files changed

Draft

Feat security#102
dominikletica wants to merge 181 commits into
dev-latestfrom
feat-security

Commits

Commits on Jun 15, 2026

Plan security hardening branches
dominikletica
committed
Refine security hardening branch plans
dominikletica
committed
Document legacy security plugin reference
dominikletica
committed
Add security PR readiness planning notes
dominikletica
committed
Document accessible IconCaptcha quiz fallback
dominikletica
committed
Add security planning edge-case guardrails
dominikletica
committed
Document security log projection question
dominikletica
committed
Document IP retention security limits
dominikletica
committed
Merge pull request #101 from aavion/feat-security-planning
dominikletica
authored
Add security policy defaults
dominikletica
committed
Adjust captcha challenge TTL default
dominikletica
committed
Refine website global rate defaults
dominikletica
committed
Tighten scheduler and probe security defaults
dominikletica
committed
Define recovery login bypass policy
dominikletica
committed
Clarify captcha auto-success limits
dominikletica
committed
Document security enforcement policy order
dominikletica
committed
Document security configuration surfaces
dominikletica
committed
Document security surface coverage gaps
dominikletica
committed
Add admin ACL enforcement branch plan
dominikletica
committed
Detail admin ACL enforcement plan
dominikletica
committed
Merge pull request #103 from aavion/feat-security-policy-docs
dominikletica
authored
Add GeoIP resolver foundation
dominikletica
committed
Add MaxMind GeoIP provider
dominikletica
committed
Add GeoIP database update foundation
dominikletica
committed
Prevent GeoIP license key logging
dominikletica
committed
Assert GeoIP operations keep license key private
dominikletica
committed
Seed GeoIP defaults during setup
dominikletica
committed
Surface GeoIP status in statistics settings
dominikletica
committed
Simplify GeoIP status scope
dominikletica
committed
Align settings API GeoIP redaction test
dominikletica
committed
Harden GeoIP archive extraction
dominikletica
committed
Harden GeoIP path portability
dominikletica
committed
Harden GeoIP TAR validation
dominikletica
committed

Commits on Jun 16, 2026

Address GeoIP review findings
dominikletica
committed
Address GeoIP review follow-ups
dominikletica
committed
Reject unsupported GeoIP databases
dominikletica
committed
Merge pull request #104 from aavion/feat-security-geoip-observability
dominikletica
authored
Prepare abuse foundation worklog
dominikletica
committed
Document abuse foundation log projection scope
dominikletica
committed
Add database log projection foundation
dominikletica
committed
Move admin log browsing to database projections
dominikletica
committed
Clarify trusted proxy scope for abuse foundation
dominikletica
committed
Clarify visitor identity proxy header policy
dominikletica
committed
Use forwarding entropy for visitor fallback IDs
dominikletica
committed
Add passive abuse request inspection
dominikletica
committed
Record passive abuse signals
dominikletica
committed
Make probe path patterns configurable
dominikletica
committed
Track probe path route warning follow-up
dominikletica
committed
Specify follow-up notice
dominikletica
committed
Record session visitor mismatch signals
dominikletica
committed
Clarify security header handoff
dominikletica
committed
Use clock for security signal retention
dominikletica
committed
Harden log projection readiness
dominikletica
committed
Record abuse foundation final verification
dominikletica
committed
Restore application log browsing source
dominikletica
committed
Split admin log browsing facade
dominikletica
committed
Harden database log browsing filters
dominikletica
committed
Clarify abuse identity and intent policies
dominikletica
committed
Update dependencies and support guidelines
dominikletica
committed
Address log browsing review gaps
dominikletica
committed
Document retention-bound enforcement windows
dominikletica
committed
Simplify security signal retention settings
dominikletica
committed
Harden log browsing retention and pagination
dominikletica
committed
Tighten abuse classification path handling
dominikletica
committed
Document abuse foundation review fixes
dominikletica
committed
Cover log settings navigation
dominikletica
committed
Update abuse foundation verification notes
dominikletica
committed
Harden abuse foundation review edges
dominikletica
committed
Harden abuse foundation review findings
dominikletica
committed
Gate access surface locale prefixes
dominikletica
committed
Harden log filters and request intents
dominikletica
committed
Merge pull request #105 from aavion/feat-security-abuse-foundation
dominikletica
authored
Add admin ACL feature matrix
dominikletica
committed
Gate settings through admin ACL features
dominikletica
committed
Enforce admin ACL on package workflows
dominikletica
committed
Invalidate admin ACL group cache on group changes
dominikletica
committed
Document admin ACL enforcement slice
dominikletica
committed
Enforce admin ACL on user workflows
dominikletica
committed
Enforce admin ACL on operational surfaces
dominikletica
committed
Document admin ACL enforcement decisions
dominikletica
committed
Update navigation ACL expectations
dominikletica
committed
Improve admin ACL reviewability
dominikletica
committed
Record admin ACL audit follow-up
dominikletica
committed
Fix delegated admin ACL bypasses
dominikletica
committed
Fix admin ACL review findings
dominikletica
committed
Merge pull request #106 from aavion/feat-security-admin-acl-enforcement
dominikletica
authored
Start rate enforcement branch
dominikletica
committed

Commits on Jun 17, 2026

Document rate enforcement policy catalogue
dominikletica
committed
Add rate limit policy catalogue
dominikletica
committed
Add rate limit mode setting
dominikletica
committed
Add rate limit decision facade
dominikletica
committed
Enforce rate limits on requests
dominikletica
committed
Add rate limit reset hooks
dominikletica
committed
Document rate enforcement implementation
dominikletica
committed
Harden rate limit scheduler policy
dominikletica
committed
Scale suspicious probe profile windows
dominikletica
committed
Cover cron rate limit route rendering
dominikletica
committed
Clarify scheduler rate limit policy
dominikletica
committed
Record custom error page follow-up
dominikletica
committed
Version bump -> 0.2.5
dominikletica
committed
Translate rate limit profile labels
dominikletica
committed
Update importmap dependencies
dominikletica
committed
Fix rate enforcement review findings
dominikletica
committed
Fix rate limiter auth-stage bypasses
dominikletica
committed
Harden rate limiter review edge cases
dominikletica
committed
Fix rate limiter bypass review findings
dominikletica
committed
Tighten rate limiter review hardening
dominikletica
committed
Harden rate limit probe and profile edges
dominikletica
committed
Document cache panic delivery direction
dominikletica
committed
Charge bearer CORS preflight attempts
dominikletica
committed
Charge read-only owner unsafe preflights
dominikletica
committed
Close bearer preflight and scheduler gaps
dominikletica
committed
Harden probe setup and auth-failure limits
dominikletica
committed
Codify review readiness rules
dominikletica
committed
Harden setup rate limits and error resolution
dominikletica
committed
Document rate limit and error renderer hardening
dominikletica
committed
Harden credentialed preflight rate checks
dominikletica
committed

Commits on Jun 18, 2026

Prevent partial rate limit bucket spends
dominikletica
committed
Document rate limit consume tradeoff
dominikletica
committed
Centralize API effective method policy
dominikletica
committed
Centralize path scope matching
dominikletica
committed
Move rate limit bucket policy into descriptors
dominikletica
committed
Centralize localized request path resolution
dominikletica
committed
Harden technical path rate scopes
dominikletica
committed
Merge pull request #107 from aavion/feat-security-rate-enforcement
dominikletica
authored
Prepare auto-ban response policy
dominikletica
committed
Document auto-ban scoring policy
dominikletica
committed
Add auto-ban signal enforcement core
dominikletica
committed
Add recovery login alias for auto-ban bypass
dominikletica
committed
Expose owner auto-ban review workflows
dominikletica
committed
Document auto-ban review policy
dominikletica
committed
Keep recovery login on user route
dominikletica
committed
Document locale-aware delivery boundaries
dominikletica
committed
Harden auto-ban enforcement boundaries
dominikletica
committed
Allow auto-ban recovery login submissions
dominikletica
committed
Serialize auto-ban index updates
dominikletica
committed
Fail auto-ban reset on cache delete failure
dominikletica
committed
Require auto-ban reset signal persistence
dominikletica
committed
Record trigger effects only for new auto-bans
dominikletica
committed
Keep newest auto-ban detail signals visible
dominikletica
committed
Mark auto-ban API endpoints owner-only
dominikletica
committed
Document auto-ban review hardening
dominikletica
committed
Verify auto-ban rollback clears active state
dominikletica
committed
Centralize ignorable request path skips
dominikletica
committed
Require recovery marker for login ban bypass
dominikletica
committed
Fail open auto-ban when config is unavailable
dominikletica
committed
Document second auto-ban review fixes
dominikletica
committed
Enforce auto-bans over probe responses
dominikletica
committed
Harden auto-ban inspection against malformed fields
dominikletica
committed
Respect auto-ban responses during session binding
dominikletica
committed
Use occurrence ids for auto-ban owner alerts
dominikletica
committed
Document third auto-ban review fixes
dominikletica
committed
Add suspicious payload security signals
dominikletica
committed
Show trigger geo context on auto-ban detail
dominikletica
committed
Document geo traffic-shedding follow-up
dominikletica
committed
Enforce auto-bans before probe and login side effects
dominikletica
committed
Release auto-bans before reset cutoffs
dominikletica
committed
Serialize auto-ban reset cutoffs
dominikletica
committed
Preempt banned API and scheduler sources
dominikletica
committed
Harden auto-ban audit follow-ups
dominikletica
committed
Update pull request template
dominikletica
committed
Count auto-ban floor by request
dominikletica
committed
Skip trusted scheduler source scoring
dominikletica
committed
Validate auto-ban signal retention
dominikletica
committed
Document auto-ban review fixes
dominikletica
committed
Guard persisted signal retention bounds
dominikletica
committed
Derive signal retention default from auto-ban TTL
dominikletica
committed
Bound additional persisted config values
dominikletica
committed
Recheck recovery login bans after auth
dominikletica
committed
Skip trusted scheduler payload scoring
dominikletica
committed
Document auto-ban review fixes
dominikletica
committed
Bound trusted auto-ban access level
dominikletica
committed
Recheck auto-bans after payload signals
dominikletica
committed
Scan JSON bodies for payload probes
dominikletica
committed
Document auto-ban review updates
dominikletica
committed
Suppress recovery auth failures after auto-ban
dominikletica
committed
Bound suspicious payload body scanning
dominikletica
committed
Score anonymous application payload probes
dominikletica
committed
Document auto-ban review hardening
dominikletica
committed
Block protected browser auto-ban bypasses
dominikletica
committed
Merge pull request #108 from aavion/feat-security-auto-ban
dominikletica
authored

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.