uwarp-space 2026-03-05
Pre-release security hardening rounds 6–13: CORS, rate limiting, auth lockout, input validation, data isolation, settings persistence, and worker synchronization
246 files · 11,273+ · 2,036-

Security Hardening (Rounds 6–13)

harden behavioral
4 files changed
  • app.py CORS hardening, rate limiting, security headers applied across rounds 6–13
  • env_settings.py Settings persistence, CORS configuration, error sanitization improved
  • service.py Auth lockout, input validation, data isolation hardened in rounds 8–13
  • worker_sysop.py Worker synchronization improvements in round 13
  • Round 6: auth, CORS, rate limiting, and security headers hardened harden behavioral
    1 file
    • app.py
  • Rounds 8–9: 13 issues each resolved covering broad server hardening harden internal
    1 file
    • service.py
  • Round 10: auth, input validation, and data isolation hardened harden behavioral
    1 file
    • service.py
  • Round 11: rate limits, auth lockout, and security headers tightened harden behavioral
    1 file
    • app.py
  • Rounds 12–13: settings persistence, CORS, error sanitization, and worker sync improvements harden behavioral
    2 files
    • env_settings.py
    • worker_sysop.py

Auth

remediate behavioral
1 file changed
  • __init__.py Bootstrap set-password now allowed when no admin password is stored
  • Bootstrap set-password flow now permitted when no admin password has been stored — previously blocked even on fresh instances remediate behavioral
    1 file
    • __init__.py

Logging

remediate behavioral
1 file changed
  • game_state.py Structured log emitted for MetricsCalculator import failure on startup
  • Structured log now emitted for MetricsCalculator import failure at startup — previously the error was silent remediate behavioral
    1 file
    • game_state.py
← 2026-03-04 uwarp-space changelog → 2026-03-06 uwarp-space →