Feat/analytics policy inspector#96

Merged

mikeappsec merged 10 commits into

mainfrom

feat/analytics-policy-inspector

Jul 14, 2026

Commits on Jul 13, 2026

fix(security): SSRF defences, PromQL injection guard, auth-by-default, path traversal block
mikeappsec
committed

Commits on Jul 14, 2026

fix(dpop): close cnf.jkt bypass on pinned-key path, drop dead replayCacheSize
mikeappsec
committed
fix(saml): replace hand-rolled XML-DSIG with goxmldsig, fix Recipient bypass
mikeappsec
committed
fix(apikey): honor embedded argon2 params, wire in secrets rotation
mikeappsec
committed
fix(hmac): state-aware key lookup, wire in secrets rotation
mikeappsec
committed
fix(introspection): stop caching expired-but-active tokens, wire in secrets rotation
mikeappsec
committed
fix(oauth2): flow-cookie SameSite, JWKS context leak, wire in secrets rotation
mikeappsec
committed
feat(mtls): wire in CA bundle hot-reload
mikeappsec
committed
fix(controlplane): close DNS-resolution gap in probe SSRF check
mikeappsec
committed
fix(controlplane): fail closed on SSRF host resolution failure
mikeappsec
committed