ZeroLog
Private preview
Back to Newsroom

Security

22 October: security audit fixes and a zero-downtime deploy path

An audit of our own code led to fixes for access, billing, uploads and agents. Deploys can now switch between two app slots behind a proxy; the first real switch in production ran on 23 October.

User impact: Not reviewed

Everything here is in the repository history of 22 October 2026.

How a deploy switches ZeroLog to new code without downtimeVisitors, the tunnel and worker machines all connect to port 8080. An nftables table redirects that port to the active front-door proxy, either instance a on port 8084 or instance b on port 8085. The proxy sends traffic to the one active app slot, blue on port 8082 or green on port 8083. A deploy tests the new code, takes a backup, starts the idle slot, health-checks and activates it, reloads the proxy, and restarts the background worker with a drain.restart,with drainone instance at a timeactive slot onlystart idle slot,activatereload proxyApp slots, one activezerolog@blueport 8082zerolog@greenport 8083Front-door proxy (Node.js)zerolog-proxy@aport 8084zerolog-proxy@bport 8085Visitors, tunnel andworker machines(all use port 8080)nftables table zl_zdtredirects port 8080to the active proxydeploy.shtests, backup, switchzerolog-workerbackground jobs
How a deploy switches ZeroLog to new code. Diagram from the docs.
Text version

Traffic goes through a proxy to one active app slot, blue or green. A deploy starts the idle slot, checks it and switches.

Security audit

  • Access: ending a member's access ends the chat's link to the shared workspace. Superadmin accounts can only be changed, locked or deleted by a superadmin. An old invitation no longer undoes a role downgrade. WebDAV writes need the current write role. Feature switches need the settings permission.
  • Money: credit changes run one at a time per account. Refunds need the billing permission and a positive amount, and the target account is checked before the provider order. Paid add-on quotas no longer come from a user setting.
  • Agents and keys: key rules and approvals apply to the key actually used. Numeric placeholders in the key proxy bind to the signed-in context. Research and webhook AI calls follow egress rules. The internal agent_run task left the public task list, and the domain-watch run belongs to the job owner only.
  • Uploads and hosts: one writer per upload, and finishing a busy upload answers 409 instead of 500. The disk guard also freezes sandbox boxes. Host preview goes only to the one authorized target.
  • Apps: the Android bridge lost its legacy JavaScript interface, QR pairing accepts only your own server, and the sign-out hook also catches /logout/ variants. Missing secret fields were added to the secret list.

Deploys

A deploy starts the idle one of two app slots, checks it, then points the front-door proxy at it. The worker restarts with a drain, and rollback exists. Caveat: the proxy switch first ran in production on 23 October, so we claim no measured zero-downtime deploy for this day.

Also: the language sitemap, mobile canonical route and public plan cache were corrected.

Corrections belong here too. Feed · Docs · X · Legal & privacy