Security hardening — round 6: 7 confirmed defects - #16

Merged

REPPL merged 9 commits into

mainfrom

security-hunt/round-6

Aug 6, 2026

Commits on Aug 6, 2026

fix: restore user settings displaced by collection forced settings
claude
committed
c570935
fix: coerce untrusted entity text fields and cap media per card
claude
committed
d0bfec0
fix: compute collection stats min/max in a single pass
claude
committed
ed9fe85
fix: cap entity-type fan-out when loading a collection
claude
committed
a441367
fix: cap MyPlausibleMe collection-discovery fan-out
claude
committed
957e805
fix: make the hard reset tolerant of a blocked app-DB delete
claude
committed
f791bc9
docs: record round 6 in the security decisions log
claude
committed
aafb11a
fix: back up forced settings per key, not per source
claude
committed
fa4efd7
fix: drop unnecessary generic in forced-settings snapshot
claude
committed
cdc295b