akiba

akiba pushed to main at akiba/BadNote

2026-08-06 13:39:05 -05:00

307161f465 fix: restore PDF pen capture and overhaul sticky/pens/pages

akiba pushed to main at akiba/BadNote

2026-08-06 03:02:00 -05:00

ad9b1b46db docs: note tip-velocity physics is wired at capture

akiba pushed to main at akiba/BadNote

2026-08-06 03:01:08 -05:00

f31dd0fb52 fix: PDF finger ink, chrome UX, OneNote pens, and pen physics

akiba pushed to main at akiba/BadNote

2026-08-05 14:44:17 -05:00

85af037b7d fix: coalesce pinch updates and stop live zoom write-back

akiba pushed to main at akiba/BadNote

2026-08-05 07:51:24 -05:00

4f6fb69dee fix: soft-clamp pinch zoom and Krita-inspired brush opacity

akiba pushed to main at akiba/BadNote

2026-08-05 07:27:42 -05:00

2b1c6ba7e0 feat: OneNote-style notebooks, text fonts, and page navigation

akiba pushed to main at akiba/BadNote

2026-08-05 06:52:21 -05:00

4a6fe7d05e fix: Surface pen pressure, zoom glitches, sticky notes, selection UX

akiba pushed to main at akiba/BadNote

2026-08-05 06:04:53 -05:00

198da00ecd feat: vault-aligned server v1 + UX polish

akiba pushed to main at akiba/BadNote

2026-08-05 04:55:33 -05:00

d346cc2670 feat: unified shell, diagnostics pack, native Office, sticky board

akiba commented on issue akiba/agento3#5

2026-06-30 09:04:46 -05:00

[Security Audit] Missing Content-Security-Policy header

FIXED — Commit 122c408

Fix: Added Content-Security-Policy header to both site blocks in Caddyfile:

Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.jsdelivr.n…

akiba closed issue akiba/agento3#5

2026-06-30 09:04:46 -05:00

[Security Audit] Missing Content-Security-Policy header

akiba closed issue akiba/agento3#4

2026-06-30 09:04:45 -05:00

[Security Audit] Caddy timeout at exact backend limit causes intermittent 504 errors

akiba closed issue akiba/agento3#3

2026-06-30 09:04:44 -05:00

[Security Audit] Stored XSS in stats dashboard - unescaped URL paths

akiba commented on issue akiba/agento3#4

2026-06-30 09:04:44 -05:00

[Security Audit] Caddy timeout at exact backend limit causes intermittent 504 errors

FIXED — Commit 122c408

Fix: Changed all read_timeout 30s → read_timeout 60s and write_timeout 30s → write_timeout 60s in Caddyfile (9 blocks: SW routes, main proxy, stats…

akiba commented on issue akiba/agento3#3

2026-06-30 09:04:42 -05:00

[Security Audit] Stored XSS in stats dashboard - unescaped URL paths

FIXED — Commit 122c408

Fix: Added import html and replaced p["path"] with html.escape(p["path"]) in the stats dashboard HTML template (app.py:390).

Deployed via start.sh — workers…

akiba pushed to main at akiba/agento3

2026-06-30 09:04:01 -05:00

122c408fff fix: resolve 3 security audit issues

akiba commented on issue akiba/agento3#3

2026-06-30 08:01:50 -05:00

[Security Audit] Stored XSS in stats dashboard - unescaped URL paths

Triage Assessment: HIGH severity

This is a critical stored XSS vulnerability. User-controlled URL paths are rendered unescaped in the /stats dashboard, allowing arbitrary script execution.

**…

akiba commented on issue akiba/agento3#4

2026-06-30 08:01:48 -05:00

[Security Audit] Caddy timeout at exact backend limit causes intermittent 504 errors

Triage Assessment: MEDIUM severity

This is a valid race-condition bug. When both retries are consumed, the backend takes exactly 30s — matching Caddy's read/write timeout and causing…

akiba commented on issue akiba/agento3#5

2026-06-30 08:01:45 -05:00

[Security Audit] Missing Content-Security-Policy header

Triage Assessment: LOW severity

This is a valid security audit finding. The application is missing a CSP header, which would provide defense-in-depth against XSS (especially relevant given…

akiba commented on issue akiba/agento3#5

2026-06-30 04:02:09 -05:00

[Security Audit] Missing Content-Security-Policy header

🤖 Triage Summary

Status: Confirmed — legitimate LOW severity security finding. Labels: bug ✅ Assignee: akiba ✅

Next Steps

Add CSP header either via Caddyfile…