Jeff Emmett bc810d34e4 fix(security): low-severity hardening and security headers ... - L-1: Remove internal error details from SIWE verify response - L-2: Stop forwarding raw Safe API error bodies to clients (log server-side) - L-3: Evict stale keys from nonce rate limiter to prevent memory leak - L-4: Add input length/type guards on wallet-link verify body fields - L-5: Sanitize and cap limit query param on Safe transfers route (max 200) - L-6: Server recomputes addressHash from SIWE address instead of trusting client-supplied value for dedup - L-7: Reset LinkedWalletStore singleton on logout to clear cached keys - I-1: Add X-Content-Type-Options, X-Frame-Options, Referrer-Policy headers - I-9: Build EIP712Domain type array dynamically from domain fields in ExternalSigner.signTypedData (was hardcoded to empty, dropping fields) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>		2026-03-09 18:06:07 -07:00
..
components	fix(security): rate limit, sender verification, icon sanitization, SSRF prevention	2026-03-09 17:51:18 -07:00
landing.ts	refactor: complete rfunds → rflows rename across configs and references	2026-03-03 19:13:14 -08:00
mod.ts	fix(security): low-severity hardening and security headers	2026-03-09 18:06:07 -07:00