fix(security): admin token auth, localhost-only API, path validation, input limits, per-user port#2062

Closed

thedotmack wants to merge 2 commits intomainfrom

bugfix/security-bugs

Commits on Apr 18, 2026

fix(security): admin token auth, localhost-only API, path validation, input limits, per-user port

thedotmack
and
claude
committed
fix: address review - mandatory admin token, realpath validation, byte-based truncation, larger port range

thedotmack
and
claude
committed