Security hardening: RCE upgrade, role-aware RLS, OAuth connector binding - #21

Merged

aliihsaad merged 8 commits into

security/safe-hardening-pass

Sep 12, 2026

Commits on Sep 12, 2026

Harden rate-limit table RLS, settings action auth, and secret comparisons
aliihsaad
committed
f175338
Upgrade Next.js to 16.3.5 and sharp to 0.35.4 (unauthenticated RCE fixes)
aliihsaad
committed
acc1ba7
Deploy automation-worker-send-email with the other automation workers
aliihsaad
committed
0763d72
Finish advisor function hardening: revoke trigger-only RPC, pin search_path
aliihsaad
committed
05dc2eb
Make RLS role-aware on workspace_settings and social_accounts
aliihsaad
committed
02cb64e
Bind OAuth redirect_uri to registered clients and make codes single-use
aliihsaad
committed
49b831a
Extend role-aware RLS to the remaining role-blind tables
aliihsaad
committed
3648f28
Bound pg_cron run-history growth and document the size reclaim
aliihsaad
committed
70a5667