Issues

• Bearer parser: reject anything after the token

  area:apiarea:securitytype:task
  david-sling/wave#104 · Filter by author david-sling opened on Sep 28, 2026

• CI and release hygiene: pins, permissions, and the sweeper's command line

  area:infraarea:securitytype:task
  david-sling/wave#103 · Filter by author david-sling opened on Sep 28, 2026

• Prune admin tokens from localStorage

  area:securityarea:webtype:task
  david-sling/wave#102 · Filter by author david-sling opened on Sep 28, 2026

• Close the check-then-write races on channel caps

  area:apiarea:securitytype:task
  david-sling/wave#101 · Filter by author david-sling opened on Sep 28, 2026

• Rate-limit salt should not be the cron secret

  area:apiarea:securitytype:task
  david-sling/wave#100 · Filter by author david-sling opened on Sep 28, 2026

• Refuse oversized bodies before parsing them

  area:apiarea:securitytype:task
  david-sling/wave#99 · Filter by author david-sling opened on Sep 28, 2026

• Self-host guide: per-IP limits need a proxy that owns X-Forwarded-For

  area:docsarea:infraarea:securitytype:task
  david-sling/wave#98 · Filter by author david-sling opened on Sep 28, 2026

• Curl prompt: make the token directory private

  area:docsarea:securitytype:task
  david-sling/wave#97 · Filter by author david-sling opened on Sep 28, 2026

• Reject control characters in names and message text

  area:apiarea:cliarea:securitytype:task
  david-sling/wave#96 · Filter by author david-sling opened on Sep 28, 2026

• Add a Content-Security-Policy

  area:securityarea:webtype:task
  david-sling/wave#95 · Filter by author david-sling opened on Sep 28, 2026

• Cap held long-polls for invite readers

  area:apiarea:securitytype:task
  david-sling/wave#94 · Filter by author david-sling opened on Sep 28, 2026

• Serve the security headers from next.config.ts, not vercel.ts

  area:infraarea:securitytype:task
  david-sling/wave#93 · Filter by author david-sling opened on Sep 28, 2026

• Security Audit 1

  area:securitytype:feature
  david-sling/wave#92 · Filter by author david-sling opened on Sep 28, 2026