NUXER e7cd1848c9 fix(security): deny writes to read-blocked Hermes credential stores ...

Read guards already refuse auth.json, webhook HMAC secrets,
google_oauth.json, the Bitwarden plaintext cache, vault/, and
browser-profile/. The write denylist only covered .env, the Anthropic
PKCE store, and bws_cache.enc.json, so write_file/patch could replace
the rest.

Drive the write denylist from the same credential names and
read-denied directories. Keep the extra write-only entries
(bws_cache.enc.json, state.db, sessions, pairing).

Fixes #110464
Related: #108716

2026-09-15 06:20:15 -07:00

..

developer-guide

docs(cron): record the due-only occurrence identity in the missed-occurrence contract

2026-09-15 06:07:32 -07:00

getting-started

fix(nix): container mode does not linger the host service user; document the cron/linger dependency

2026-09-15 04:03:25 -07:00

guides

docs(gemini): scope the base-URL normalization claim to the Google host and TTS

2026-09-15 03:54:01 -07:00

integrations

test(auth): OpenRouter PKCE invariants, fake-authority A/B harness, docs, contributor map

2026-09-12 22:07:41 -07:00

reference

fix(config): hermes config get masks credentials on every path; --raw opts out

2026-09-15 05:08:55 -07:00

user-guide

fix(security): deny writes to read-blocked Hermes credential stores

2026-09-15 06:20:15 -07:00

index.mdx

docs: eight small accuracy fixes from open type/docs issues

2026-09-08 19:00:02 +05:30

user-stories.mdx

…