4grayandClaude Fable 5 552923fd55 fix(electron): strip credentials on same-host https-to-http downgrades ...

Review follow-up (Greptile P1 + Codex on #1322): the host-only check
kept Authorization/Cookie/basic auth/params/body when an https request
was redirected to http on the same host, replaying a TLS-obtained
session in cleartext. Treat that downgrade like a host change: strip
credentials and refuse to replay request bodies. Scheme upgrades and
port moves on the same host keep headers — the actual #1158 scenarios.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-01 13:27:47 +02:00

..

architecture

fix(electron): strip credentials on same-host https-to-http downgrades

2026-08-01 13:27:47 +02:00

superpowers

fix(playback): structure Shaka diagnostics (#1318)

2026-07-31 21:25:06 +02:00