Vito Sansevero 6c4c587d9e fix(images): accept Show in folder only as a same-origin JSON request, one at a time ...

- require an Origin equal to the request's own scheme://host:port and,
  when sent, Sec-Fetch-Site: same-origin; refuse every forwarding-style
  header (Via, X-Forwarded-*, X-Original-*, *-Client-IP, CF-Connecting-IP
  and the rest) as remote (security review M1, L2)
- answer a non-JSON body with 415, so a cross-origin request always needs
  a CORS preflight (L2)
- single flight plus a 1 s cooldown per process: 429 code busy (L1)
- path resolution errors such as ENAMETOOLONG are a JSON 404, and neither
  that nor a start failure logs the client's path at error level (L3)

2026-10-20 21:34:24 -07:00

..

api

fix(images): accept Show in folder only as a same-origin JSON request, one at a time

2026-10-20 21:34:24 -07:00

__init__.py

style: apply Black formatter (line-length=88) to all Python files

2026-02-07 08:30:09 -08:00

autotag.py

Hardening: security fixes, queue-time run counting, background jobs, 85%+ test coverage (#153)

2026-10-08 18:53:11 -07:00

config.py

Hardening: security fixes, queue-time run counting, background jobs, 85%+ test coverage (#153)

2026-10-08 18:53:11 -07:00

lora_utils.py

ci: cancel superseded PR runs and make the bandit job a real gate (#231)

2026-10-18 18:00:21 -07:00