Codex state update: Implemented locally: Xenon output is now captured with stderr, and jscpd ignores VCS/generated/build/report artifacts. Verified with `bash -n scripts/check-security-audit.sh…
Closing per user request; this issue is covered by the local changes ready to push.
Fixed locally: credentialed CORS startup rejects wildcard origins and requires explicit origins.
Closing per user request; this issue is covered by the local changes ready to push.
Fixed locally: audit/config redaction detects compound secret keys and configuration safety rejects nested…
Closing per user request; this issue is covered by the local changes ready to push.
Fixed locally: fallback UI API keys are no longer persisted in localStorage; newly entered keys are held in…
Closing per user request; this issue is covered by the local changes ready to push.
Fixed locally: installer run-record database credentials are redacted and raw URLs are kept in a private…
Codex state update: implemented locally in /mnt/DATA/git/govoplan-core.
Summary:
- The browser fallback automation API key is no longer saved to
localStorage. - Newly entered fallback keys…
Codex state update: implemented locally in /mnt/DATA/git/govoplan-core.
Summary:
- Added shared structured secret redaction for audit details and configuration control output.
- Compound/camel/k…
Codex state update: implemented locally in /mnt/DATA/git/govoplan-core.
Summary:
- Runtime startup now rejects
*inGOVOPLAN_CORS_ALLOW_ORIGINSwhile credentialed CORS is enabled. - Added a…