fix: Harden webhook, vault, session, and base client paths#654

Merged

gjtorikian merged 13 commits into

mainfrom

May 11, 2026

Commits on May 7, 2026

fix: percent-encode path segments in base client

gjtorikian
and
claude
committed
fix: add structured failure reasons for session refresh

gjtorikian
and
claude
committed
fix: force public clients to drop the API key

gjtorikian
and
claude
committed
fix: use symmetric tolerance check for webhook timestamps

gjtorikian
and
claude
committed
fix: bound LEB128 decode to 32 bits in vault payload

gjtorikian
and
claude
committed
fix: preserve empty AAD in vault crypto helpers

gjtorikian
and
claude
committed
fix: treat tolerance=0 as a valid window in webhook verifier

gjtorikian
and
claude
committed
style(session): apply ruff format

gjtorikian
and
claude
committed

Commits on May 11, 2026

fix(client): pass path as sequence of segments to prevent traversal

gjtorikian
and
claude
committed