CP-26002: validate ARK_DISCOVERY_API itself against the domain allowlist - #830

Merged

wallrj-cyberark merged 6 commits into

jetstack:masterfrom

roeezis:CP-26002-validate-discovery-baseurl

Sep 9, 2026

Commits on Sep 8, 2026

CP-26002: validate ARK_DISCOVERY_API itself against the domain allowlist

rzisholz
authored and
wallrj-cyberark
committed
030a141
CP-26094: warn-only tenant-subdomain check on discovery-derived hosts

rzisholz
authored and
wallrj-cyberark
committed
a5ff45c
CP-26094: correct threat-model overclaim, assert V(2) log content

rzisholz
authored and
wallrj-cyberark
committed
ed9c325
Fix review findings on the mock-transport rework, trim internal jargon from comments

rzisholz
authored and
wallrj-cyberark
committed
e8b6cd1

Commits on Sep 9, 2026

Stop echoing untrusted response content into errors that can reach an Event
rzisholz
committed
7a20418
Address review: leak in base-URL error, unmatchable warning, untested guard
rzisholz
committed
6ad5a78