ZeroLog
Geschlossene Vorschau
Zurück zum Newsroom

Übersetzung noch nicht verfügbar. Der Originaltext wird angezeigt.

Sicherheit

24 September: security hardening for previews, sign-in and WebDAV

A set of security fixes went live on 24 September. The old standalone builder console was removed.

Nutzerwirkung: Noch nicht bewertet

Added on 23 October 2026 from the repository history.

Where a workspace runs and how traffic leaves itYour browser talks to the app server. The app server asks a filtered container API to start your workspace on a worker machine, either as a gVisor container or, on the Ultra plan, inside a Kata micro-VM. A workspace sits on an internal network with a single exit: the egress broker, which applies target and port rules. Calls that need a stored third-party key go on to a separate key service.Key service (separate VM)Worker machines, one workspace eachClass: vm (Ultra plan)Class: standardcreate, stoponly way outonly way outallowed targetshosts with a key profilereal key insertedstart, stopBrowser, CLI or appApp server (control plane)sign-in, chats, approvalsFiltered container APIno Docker socketin workspacesYour workspacegVisor user-space kernelall capabilities droppedinternal network onlyYour workspaceKata micro-VMown guest kernelinternal network onlyEgress brokerruns inside the app processtarget and port rulesPublic internetThird-party keys, encryptedmutual TLS from app host onlyThird-party APIs
Where a workspace and its preview are separated from the rest. Diagram from the docs.
Text version

Every workspace runs in its own container. A shared preview is shown in a sandbox with its own origin and cannot reach the account or follow links out of the container.

Security

  • Shared preview links (/s/) run the page in a sandbox with an opaque origin. A preview no longer follows symlinks out of your container.
  • Passkey sign-in and "forgot password" no longer reveal whether an account exists for an address. The passkey relying-party ID is no longer taken from a forwarded host header.
  • WebDAV (/dav) limits failed password attempts per address and hashes passwords off the main thread.
  • Sessions started from one device are linked, so revoking a session also revokes the related ones.
  • WebHook AI targets go through the research blocklist, and redirects are not followed.
  • A security.txt (RFC 9116) and an MTA-STS policy for mail are published.

Fixed

  • The sitemap no longer lists pages that return 404.

Removed

  • The old standalone builder console (admin.zerolog.ch and /builder/?embed=1). /builder now forwards to /next/builder/. The builder itself is unchanged.

Auch Korrekturen gehören hierher. Feed · Doku · X · Recht & Datenschutz