Commit graph

2 commits

Author SHA1 Message Date
google-labs-jules[bot]
c9dc0fd8f6 🛡️ Sentinel: Fix information leakage in web dashboard
Modified `scripts/web_dashboard.py` to:
- Catch all exceptions in the dashboard route.
- Log exceptions securely using `logging` instead of printing to stdout.
- Return a generic "Internal Server Error" message (500) instead of the raw exception string.

This prevents internal implementation details (e.g., file paths, database errors) from being exposed to the user.

Added `test_error_leakage` to `scripts/test_web_dashboard.py` to verify the fix and prevent regressions.
2026-02-10 11:34:39 +00:00
google-labs-jules[bot]
9b6778cba0 Fix CRITICAL authorization bypass in Telegram Bot
- Changed `check_authorized` in `scripts/telegram_deploy_bot.py` to fail closed (deny all) if `TELEGRAM_ALLOWED_USER_IDS` is unset or empty.
- Updated `scripts/TELEGRAM_BOT_SETUP.md` and `QUICK_DEPLOY.md` to document that `TELEGRAM_ALLOWED_USER_IDS` is now mandatory for bot access.
- Added Sentinel Journal entry in `.jules/sentinel.md` documenting the vulnerability and learning.
- Verified fix with reproduction script.
2026-02-07 11:33:43 +00:00