6 Commits

Author	SHA1	Message	Date
KoalaDev	cc97e0d371	fix(security): prevent admin token length leak via timing side-channel ... isAdminMetricsAuthorized() returned early when buffer lengths differed, allowing an attacker to discover the token length by measuring response time. Now always calls crypto.timingSafeEqual (using a zeroed dummy buffer on length mismatch) so every auth attempt takes constant time regardless of whether the length guess was correct. Reported-by: Kaia-Alenia	2026-06-16 04:21:15 +02:00
Timo	d76e9195c4	fix(server): race condition on concurrent peer joins, crash-safe teardown, smart unhandled rejection handling ... - Add per-peerId serialization lock (peerJoinLocks) to prevent concurrent dedupe races - Wrap removePeerFromRoom calls in disconnect/leave/reaper with try/catch - Replace immediate process.exit on unhandledRejection with rate-limited smart exit - Optimize buildHealthPayload from 3-pass array ops to single for-of loop - Reset rateLimitDenied counters in stopServerForTests Release v2.3.1	2026-06-15 13:14:00 +02:00
Timo	34f0c2b265	chore(release): v2.2.3 — artifact attestations, bugfixes, rate limit metrics	2026-06-10 00:56:29 +02:00
Koala	4f4cdcd8c0	Cache health responses server-side	2026-06-03 11:04:45 +02:00
Koala	602be3a724	Tighten health endpoint hardening	2026-06-03 10:59:08 +02:00
Koala	81c50eff16	Harden room discovery and health metrics	2026-06-03 10:48:49 +02:00