Security hardening — round 10: 5 confirmed defects - #20

Merged

REPPL merged 6 commits into

mainfrom

security-hunt/round-10

Aug 14, 2026

Commits on Aug 14, 2026

fix: bound untrusted field-path length to stop quadratic parse
claude
committed
aeb4eb5
fix: use null-prototype map for Competing card data
claude
committed
f0797d2
fix: cap verdictFields to stop uncapped display-config DoS
claude
committed
3abd77f
fix: mount CardExpanded lazily in list and compact card items
claude
committed
26aed4c
fix: clear service-worker caches on hard reset
claude
committed
8ca22a0
docs: log round 10 security-hardening decisions
claude
committed
b47f356