* Model active evidence in result persistence
* Expose active action diagnostics
* Persist truthful DNS action evidence
* Persist direct action evidence
* feat: add authenticated durable run API v1
* Make API file interchange JSONL-only
* Harden API evidence boundaries
* Remove API rate limiter
* Unify API runs with result persistence
* Support target action runs
* Keep DNS resolver selection action-neutral
* Add action-neutral CLI resolver selection
* Preserve API evidence across JSONL round trips
* Complete HarvestView API run parity
* Harden HarvestView run API contracts
* Remove obsolete bundled network snapshots
Delete the unused bundled AWS IP-range and resolver snapshots while preserving operator-supplied resolver file input.
* refactor: canonicalize URL results
* docs: define a bounded test budget
* Standardize hostname and IP result names
* fix(api): avoid duplicate evidence conflicts
- Introduced comprehensive security tests, including CORS configuration, XML injection prevention, path traversal prevention, and information disclosure protection.
- Improved input sanitization for filenames and XML content to mitigate injection attacks and ensure safe handling.
- Updated CORS middleware to restrict HTTP methods and block credentials with wildcard origins.
- Removed traceback exposure in API error responses, even in debug mode.
- Verified rate limiting and input validation for sensitive API endpoints.
- Ensured no hardcoded secrets are present in the main codebase.
NotoriousRebel