Production hardening: 18 bugs from review + stress test - #1

Merged

BorisYamp merged 16 commits into

mainfrom

production-hardening-2026-04

Apr 29, 2026

Commits on Apr 28, 2026

chore(repo): fix path comment typos and drop orphan mass_freez.yaml
BorisYamp
committed
d856006
fix(ctl): close umask race between bind() and set_permissions()
BorisYamp
committed
92e3071
fix(alert): truncate messages to Telegram's 4096 UTF-16 limit
BorisYamp
committed
238795b
fix(detector/state): unique tmp filename to prevent concurrent save race
BorisYamp
committed
14cdfe0
fix(detector/rules): include attacking IPs in auth_failures details
BorisYamp
committed
18fe7bf
fix(action/script): truncate env vars + document never-eval security note
BorisYamp
committed
cfe200d
feat(config): make self-check thresholds and disk_cache_ttl tunable
BorisYamp
committed
287c63f
fix(monitor): config-driven disk_cache_ttl, default 5 s (was 60 s)
BorisYamp
committed
dc70bb3
fix(action/process): hardcoded protection floor, correct sysinfo, skip own/kernel threads
BorisYamp
committed
d589d8f
fix(main): self-check cooldown, restore_blocked_ips strict-log, --validate flag
BorisYamp
committed
ae093b1
fix(systemd): add RuntimeDirectory and AF_NETLINK; permit /run for firewall scripts
BorisYamp
committed
356d82f
feat(examples): iptables-based block/unblock scripts that work under hardening
BorisYamp
committed
3c5f949
fix(monitor): correct shared state and close log-injection vector
BorisYamp
committed
6b9a7c7
fix(file_monitor): wire start_file_monitoring at startup, match events under watched directory
BorisYamp
committed
a984008
fix(builder+ctl): silence cosmetic startup warnings; restore default SIGPIPE in CLI
BorisYamp
committed
5cf640f
fix(builder+alert): wire up alert-channel footguns surfaced by white-spot tests
BorisYamp
committed
0a1111f

Navigation Menu

Production hardening: 18 bugs from review + stress test - #1

Production hardening: 18 bugs from review + stress test#1
BorisYamp merged 16 commits into
mainfrom
production-hardening-2026-04

Commits on Apr 28, 2026

chore(repo): fix path comment typos and drop orphan mass_freez.yaml

fix(ctl): close umask race between bind() and set_permissions()

fix(alert): truncate messages to Telegram's 4096 UTF-16 limit

fix(detector/state): unique tmp filename to prevent concurrent save race

fix(detector/rules): include attacking IPs in auth_failures details

fix(action/script): truncate env vars + document never-eval security note

feat(config): make self-check thresholds and disk_cache_ttl tunable

fix(monitor): config-driven disk_cache_ttl, default 5 s (was 60 s)

fix(action/process): hardcoded protection floor, correct sysinfo, skip own/kernel threads

fix(main): self-check cooldown, restore_blocked_ips strict-log, --validate flag

fix(systemd): add RuntimeDirectory and AF_NETLINK; permit /run for firewall scripts

feat(examples): iptables-based block/unblock scripts that work under hardening

fix(monitor): correct shared state and close log-injection vector

fix(file_monitor): wire start_file_monitoring at startup, match events under watched directory

fix(builder+ctl): silence cosmetic startup warnings; restore default SIGPIPE in CLI

fix(builder+alert): wire up alert-channel footguns surfaced by white-spot tests