Security context

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

src/wisp.gleam: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Path Traversal: Improper ordering of operations allows directory traversal sequences to bypass sanitization when percent-encoded, permitting arbitrary file reads on the host filesystem. This is represented by CVE-2026-28807.

Auth Bypass: Heuristic detection of signed values can allow malformed or unsigned cookies to bypass signature verification checks, leading to session spoofing or privilege escalation.

Denial of Service: Improperly limited or unthrottled multipart form body parsing allows unauthenticated remote attackers to exhaust memory or disk space via large payloads.