fix(security): Phase 0 audit fixes — actively exploitable findings#982

Merged

boorad merged 8 commits into

mainfrom

feat/security-audit

Apr 27, 2026

Commits on Apr 27, 2026

fix(security): correct byte-offset handling in setAAD, timingSafeEqual, X.509
boorad
committed
fix(security): advance XSalsa20 keystream across update() calls
boorad
committed
fix(security): validate peer public keys in DH/ECDH computeSecret
boorad
committed
fix(security): close RSA PKCS#1 v1.5 Bleichenbacher oracle
boorad
committed
fix(security): restore RSA publicDecrypt empty-plaintext recovery
boorad
committed
fix(security): use ERR_get_error (oldest) for RSA empty-recovery match
boorad
committed
chore(claude): require user test confirmation before pushing fixes
boorad
committed
chore(example): use workspace dep + refresh Podfile.lock
boorad
committed