Skip to content

Harden HTTP transport routing and lifecycle - #46

Merged
DavertMik merged 2 commits into
mainfrom
fix/http-transport-security
Sep 15, 2026
Merged

DavertMik merged 2 commits into
mainfrom
fix/http-transport-security

Conversation

@DenysKuchma

Copy link
Copy Markdown
Contributor

Summary

  • prevent path traversal through project and resource IDs
  • require one canonical project-bound OAuth resource
  • restrict the MCP endpoint to POST requests
  • reliably close MCP transport and Testomat.io API sessions
  • document required Cloudflare rate limiting

@DavertMik
DavertMik merged commit d40c6a5 into main Sep 15, 2026
1 check passed
@DavertMik
DavertMik deleted the fix/http-transport-security branch September 15, 2026 22:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants