adminandClaude Sonnet 4.6 8fe036bc1a fix: P2 API hardening — unbounded SELECTs, export audit log, header injection, empty-key guard ...

- export: add .limit(10000), sanitize filename, write_audit_log on every export
- stats: add .limit(10000) to aggregation query
- settings POST: reject empty string values to prevent silent key deletion

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

2026-07-12 21:25:35 +08:00

..

ai/risk-flags

security: CAPA privilege escalation, CSV injection, AI rate-limit, prompt injection guard, open redirect, timing-safe cron secret, server-only admin client, notifications RLS

2026-07-12 17:33:58 +08:00

export

fix: P2 API hardening — unbounded SELECTs, export audit log, header injection, empty-key guard

2026-07-12 21:25:35 +08:00

stats

fix: P2 API hardening — unbounded SELECTs, export audit log, header injection, empty-key guard

2026-07-12 21:25:35 +08:00