security: harden Time for a public repo (forged beats, stranger retries, token in browser pass, worker shell sandbox) #45

Merged

teahubxyz merged 1 commits from security/public-repo-hardening into main

2026-10-14 04:24:43 +00:00

Author	SHA1	Message	Date
claude	180f5d1977	security: authenticate beats and verdicts, sandbox the worker shell and browser pass - beats_of/verdict/retry: trust only github-actions[bot] and owner/member/collaborator authors (forged state and stranger retries on a public repo) - touches_protected: paginate pull files and include previous_filename - browser_check: drop .git after clone, serve only the venture folder, Chrome with no network but localhost - Hands.run: execute in a docker container when a daemon exists (TIME_RUN_IMAGE), host shell fallback - tests: logins on fake comments, stranger retry/forged beat cases, paginated files fake Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6	2026-10-13 21:22:39 -07:00

Author

SHA1

Message

Date

claude

180f5d1977

security: authenticate beats and verdicts, sandbox the worker shell and browser pass

- beats_of/verdict/retry: trust only github-actions[bot] and owner/member/collaborator authors (forged state and stranger retries on a public repo)
- touches_protected: paginate pull files and include previous_filename
- browser_check: drop .git after clone, serve only the venture folder, Chrome with no network but localhost
- Hands.run: execute in a docker container when a daemon exists (TIME_RUN_IMAGE), host shell fallback
- tests: logins on fake comments, stranger retry/forged beat cases, paginated files fake

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6

2026-10-13 21:22:39 -07:00