jaredandClaude Opus 5.5
5c4e4dc099
Lint / JS (eslint) (push) Successful in 7s
Lint / Python (flake8) (push) Successful in 1m9s
Lint / Notify on failure (push) Skipped
Lint / Deploy (push) Skipped
Security / Python Security (bandit) (push) Successful in 1m33s
Test / Python Tests (pytest) (push) Successful in 1m54s
Lint / Python (flake8) (pull_request) Successful in 1m19s
Lint / JS (eslint) (pull_request) Successful in 7s
Lint / Notify on failure (pull_request) Skipped
Lint / Deploy (pull_request) Skipped
Security / Python Security (bandit) (pull_request) Successful in 1m16s
Test / Python Tests (pytest) (pull_request) Successful in 1m29s
Remote-User/Name/Email/Groups were read from every request, so a LAN host connecting to the container directly could claim any user and group. Add auth.trusted_proxies and ignore those headers unless the request came from one of them: the X-Real-IP the local nginx sets, or the peer address when gunicorn is reached directly. With nothing configured, nobody is trusted. Rejected attempts are logged, and /api/avatar now uses the same check. The container's nginx site blanks the same headers for non-NPM sources (pve-infra 4e3ab7c). Closes #3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>