Repository navigation

Plug security holes and redeploy the public demo - #113

Merged

Lauenburg merged 16 commits into

mainfrom

fix/security

Oct 7, 2026

Merged

Plug security holes and redeploy the public demo#113
Lauenburg merged 16 commits into
mainfrom
fix/security

Commits on Oct 7, 2026
- Harden app config and restrict data sources for the public demo
  
  Lauenburg
  and
  claude
  committed
  61bed4c
- Use an unguessable Neuroglancer viewer token
  
  Lauenburg
  and
  claude
  committed
  80ba154
- Upgrade jQuery 2.1.3 to a vendored 3.7.1
  
  Lauenburg
  and
  claude
  committed
  a03309a
- Add path traversal tests for the file routes
  
  Lauenburg
  and
  claude
  committed
  34a6b26
- Validate the FN bounding box without assert
  
  Lauenburg
  and
  claude
  committed
  ebf4a33
- Build the uWSGI image from a lock of the deployed packages
  
  Lauenburg
  and
  claude
  committed
  ed26a18
- Fix reachable dependency vulnerabilities
  
  Lauenburg
  and
  claude
  committed
  8205e19
- Restore atomicwrites in requirements.lock
  
  Lauenburg
  and
  claude
  committed
  f6baa6c
- Add a smoke test for the deployed demo
  
  Lauenburg
  and
  claude
  committed
  d4c3ab9
- Point the README demo links at the Elastic IP
  
  Lauenburg
  and
  claude
  committed
  38d6ced
- Document how the demo is deployed and rolled back
  
  Lauenburg
  and
  claude
  committed
  5abd1ee
- Document temporary SSH access now that port 22 is closed
  
  Lauenburg
  and
  claude
  committed
  4741a1c
- Trim the security tests to one per fix
  
  Lauenburg
  and
  claude
  committed
  62a30ab
- Keep account and resource IDs out of the deploy docs
  
  Lauenburg
  and
  claude
  committed
  45ed30e
- Install only torch from the PyTorch index
  
  Lauenburg
  and
  claude
  committed
  dbc9c61
- Reject oversized canvas uploads; keep state on invalid FN boxes
  
  Lauenburg
  and
  claude
  committed
  0835f7c

Commits

Commits on Oct 7, 2026