- Browse state directory carries self-contained .gitignore to prevent session state and request logs from being committed
- Node Bun.spawn polyfill regains exited promise, eager stdout/stderr drain, and output cap on Windows Node fallback
- Pre-push secret scanner now catches all-caps database passwords
- Persisted browser sessions are kept out of git regardless of repository .gitignore configuration
- App Store Connect key minted during release is scoped to the target app instead of all team apps, with revocation path disclosed in exit report
- iOS test bridge's Release compile-out is pinned by a free-tier tripwire that fails CI on regression to platform-only gate
- Browser server's Node spawn shim restores exited promise, eager stdout/stderr drain, and 16MB output cap
- Bearer-token comparison is constant-time
We read every line of external-contributor code from the last two months.
Six findings hardened, two refuted, zero backdoors.
gstack ran an explicit security sweep over all external-contributor code merged since mid-June: the seven directly-merged time-attack PRs, the two fork-port squash waves, and the roughly fifty absorbed community PRs.
About 38,000 lines across ~500 files, read with an adversarial eye.
The verdict up front: no backdoor, no exfiltration path, no live secret leak.
The contributions are net security-strengthening.
This release hardens the six real findings the sweep confirmed and locks each one behind a regression test, so the property it protects holds by construction, not by luck.
The pre-push secret scanner now catches all-caps database passwords.
Persisted browser sessions stay out of git whether or not your repo has a .gitignore.
The App Store Connect key the release flow mints is scoped to the one app you are shipping, and the exit report tells you it exists and how to revoke it.
The iOS test bridge's Release compile-out (shipped in v1.67.0.0) is now pinned by a free-tier tripwire that fails CI on any regression to a platform-only gate.
The browser server's Node spawn shim has its exited/drain/memory-cap contract back.
Bearer-token comparison is constant-time.
The pre-push credential scanner blocks a DSN whose password is a real all-caps secret (PROD2026SECRET-style) at the HIGH tier. The USER:PASSWORD documentation convention still suppresses, pinned in both directions with a table-driven test over the full placeholder set. (lib/redact-patterns.ts)
The browse state directory (.gstack/) carries a self-contained .gitignore written unconditionally when the directory is created, so persisted session-state.json cookies and browse-network.log / browse-audit.jsonl request headers can never be committed, regardless of the project's own .gitignore. (browse/src/config.ts)
The Node Bun.spawn polyfill regains its exited promise, eager stdout/stderr drain, and 16MB output cap, restoring correct child-process handling on the Windows Node fallback (cookie import, browser-skill children). (browse/src/bun-polyfill.cjs)
The iOS QA touch bridge's Release compile-out (the #if !defined(DEBUG) short-circuit plus the cSettings DEBUG define, shipped in v1.67.0.0) is pinned by a free-tier static tripwire: any regression to a platform-only gate, a reordered guard, or a dropped define fails CI on every PR. (test/ios-debug-bridge-release-guard.test.ts)
Loopback bearer-token comparison in the browse server is constant-time. (browse/src/server.ts)
The App Store Connect upload key minted during an Apple release is scoped to the target app (allAppsVisible:false with an explicit apps relationship) instead of every app on the team, and the release exit report discloses the key and its revocation path. (ship/sections/apple-release.md)
gstack-egress verify documents that ledger truncation and deletion are out of scope for the forensic-observability threat model. (bin/gstack-egress)