Audit remediation: security hardening, power-user options, packaging & docs#2

Merged

PeterM45 merged 14 commits into

mainfrom

fix/audit-0.1.2

Jun 9, 2026

Commits on Jun 9, 2026

fix(core): harden publicPaths matching against traversal and root-entry footguns
PeterM45
committed
docs(readme): correct SvelteKit static-output claim, note Bun's gate(handler, options) signature
PeterM45
committed
feat: export sitepass/proxy for programmatic use, tighten packaging metadata
PeterM45
committed
ci: smoke-test the built dist, run publint, and guard publish on tag/version match
PeterM45
committed
chore: changelog for unreleased fixes, correct stale passgate name in tsup comment
PeterM45
committed
feat(core): session revocation on password rotation, logout, bypass token, cookieSecure, hooks
PeterM45
committed
refactor(adapters): shared web-request plumbing, capped login bodies everywhere, type-boundary fixes
PeterM45
committed
feat(proxy): strip the gate cookie upstream, send X-Forwarded-*, test the forward path
PeterM45
committed
feat(cli): help/version that behave, configurable proxy, --env-file, strict flags, unit tests
PeterM45
committed
ci: concurrency groups, job timeouts, pinned Node for coverage; dependabot; issue/PR templates
PeterM45
committed
docs: README for the new surface, security-policy email fallback, dated changelog
PeterM45
committed
fix(types): typesVersions map so subpath types resolve under legacy node10 resolution
PeterM45
committed
fix: address adversarial branch review (security + correctness)
PeterM45
committed
fix: address CodeRabbit review on PR #2
PeterM45
committed