Repository navigation

Harden host handling, GitHub email linking, and password reset - #1099

Merged

kody-bot merged 6 commits into

mainfrom

cursor/security-host-and-oauth-fixes-14fa

Oct 7, 2026

Merged

Harden host handling, GitHub email linking, and password reset#1099
kody-bot merged 6 commits into
mainfrom
cursor/security-host-and-oauth-fixes-14fa

Commits on Oct 7, 2026
- Only trust allowlisted hosts in getDomainUrl
  
  cursoragent
  and
  kentcdodds
  committed
  2e14cec
- Apply the strict rate limit to /forgot-password
  
  cursoragent
  and
  kentcdodds
  committed
  e5b58a3
- Require a verified primary email for GitHub auth
  
  cursoragent
  and
  kentcdodds
  committed
  88d7a7b
- Sign out existing sessions when a password is reset
  
  cursoragent
  and
  kentcdodds
  committed
  36acd62
- Use safeRedirect in the theme switch action
  
  cursoragent
  and
  kentcdodds
  committed
  a68f11e
- Add SECURITY.md
  
  cursoragent
  and
  kentcdodds
  committed
  624ed74