mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-10-19 13:30:37 +00:00
fb7e8856bd
Security-audit fixes for dispatch, the rate limiter, MCP scopes, and secrets at rest. Operator-supplied base URLs are checked again at connect time. A Redis error falls back to the in-memory limiter. An HTTP caller with a narrow scope is scope-checked even when `OMNIROUTE_MCP_ENFORCE_SCOPES` is off. `JWT_SECRET` and `API_KEY_SECRET` stay encrypted at rest. A missing `STORAGE_ENCRYPTION_KEY` logs a loud boot warning and the process keeps serving. An empty key is the documented encryption-disabled contract (`.env.example`, `docs/reference/ENVIRONMENT.md`). Exiting would crash-loop Docker, which sets `NODE_ENV=production` and starts from the example env. This is option (b) from the 2026-10-07 hold: warn, do not `process.exit(1)`. The warning commit is on the contributor branch, co-authored. The English `docs/frameworks/MCP-SERVER.md` source hash is recorded in `.i18n-state.json`. The 66 locale mirrors stay stale, which the drift gate reports and does not fail. A full translation run is not part of this fix. ⚠️ base-red inherited: #15306 |
||
|---|---|---|
| .. | ||
| A2A-SERVER.md | ||
| ACP.md | ||
| AGENT-SKILLS.md | ||
| AGENT_PROTOCOLS_GUIDE.md | ||
| AGENTBRIDGE.md | ||
| CLOUD_AGENT.md | ||
| EMBEDDED-SERVICES.md | ||
| EVALS.md | ||
| GAMIFICATION.md | ||
| LOCAL_CORPUS_CONTEXT.md | ||
| LOG-EXPORT.md | ||
| MCP-SERVER.md | ||
| MEMORY.md | ||
| meta.json | ||
| NOTION_CONTEXT.md | ||
| OBSIDIAN_CONTEXT.md | ||
| OPEN_SSE_ARCHITECTURE.md | ||
| OPENCODE.md | ||
| PLAYGROUND_STUDIO.md | ||
| PLUGIN_MARKETPLACE.md | ||
| PLUGIN_SDK.md | ||
| PLUGINS.md | ||
| RADAR.md | ||
| SEARCH_TOOLS_STUDIO.md | ||
| SKILLS.md | ||
| TRAFFIC_INSPECTOR.md | ||
| WEBHOOKS.md | ||