Fix localStorage security issue - #643

Merged

leoisadev1 merged 44 commits into

mainfrom

tembo/fix/insecure-localstorage-chat-content-1

Feb 14, 2026

Commits on Feb 11, 2026

Investigate Convex Upstash warnings
leoisadev1
committed
8628be1
Investigate Convex Upstash warnings
leoisadev1
committed
a626c43
Merge remote-tracking branch 'origin/add-upstash-rate-limits-and' into add-upstash-rate-limits-and
leoisadev1
committed
88366b2
Apply Cubic AI review suggestions

leoisadev1
and
cubic[bot]
committed
9162dc0
Address Cubic follow-up findings

leoisadev1
and
cubic[bot]
committed
9393e14
fix(security): harden workflow endpoints and rate-limit checks
leoisadev1
committed
7cb6edd
fix(security): address remaining review findings
leoisadev1
committed
3b59d07
fix(security): address all remaining Cubic + Tembo review findings
leoisadev1
committed
1ba1454
fix(security): use HMAC+timingSafeEqual for cleanup token comparison
leoisadev1
committed
6b80816
fix(security): extract cleanup action to node runtime, fix auth bypass and error handling
leoisadev1
committed
ee54eec
fix(security): stop forwarding cookies to QStash, add rate limiting and bounds validation
leoisadev1
committed
8302416
fix(security): fix parser passthrough, remove hardcoded HMAC keys, handle fetch errors
leoisadev1
committed
4f97319
fix(security): add NaN guard to bounds validation, log fetch errors
leoisadev1
committed
04de610
fix(security): remove workflow token persistence and harden cleanup/model endpoints
leoisadev1
committed
76c4e04
fix(security): consume workflow auth refs once and harden error/rate handling
leoisadev1
committed
7c103dc
fix(security): harden fail-closed limits and workflow retries
leoisadev1
committed
8e696e5

Commits on Feb 12, 2026

Commits on Feb 13, 2026

fix(security): replace localStorage with sessionStorage for sensitive chat data
tembo[bot]
authored
7777b52

Commits on Feb 14, 2026

Merge main
leoisadev1
committed
252194b