J3vb 59ec405595 docs: record final Tauri capability posture and residual risk ...

Update the security doc's capability section with the deny list, the fact
that `http:allow-fetch` is the only URL-scoped HTTP identifier, and why
the https wildcard cannot be removed without moving the link-preview
fetch into Rust. Note under Known Limitations that narrowing the plugin
scope alone does not bound exfiltration while CSP `connect-src` allows
`https:` to any host. Add a capability row to the client architecture
doc and mark the design note implemented.

2026-07-20 14:51:23 +02:00

..

architecture

docs: record final Tauri capability posture and residual risk

2026-07-20 14:51:23 +02:00

plans

docs: record final Tauri capability posture and residual risk

2026-07-20 14:51:23 +02:00

api.md

feat(server,client): announcement channels (D1, closes A-2026-07-01)

2026-07-19 16:00:18 +00:00

audit-2026-04-07.md

chore(repo): P0 hygiene for the alpha reset

2026-07-18 11:17:29 +02:00

audit-2026-07-19.md

docs: reconcile audit backlog table with closure status

2026-07-20 12:47:34 +02:00

client-architecture.md

chore(client): remove abandoned SolidJS beachhead (D6)

2026-07-19 13:57:28 +00:00

contributing.md

chore: add Claude Code project config, git hooks, and session setup

2026-07-19 16:54:13 +00:00

deployment.md

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

livekit-setup.md

feat(server): support dual-homed voice hosts and user-managed livekit.yaml

2026-07-19 10:50:11 +00:00

port-forwarding.md

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

protocol-schema.json

feat(server,client): protocol codegen + audit quick-wins batch

2026-07-19 13:32:58 +00:00

protocol.md

feat(server,client): announcement channels (D1, closes A-2026-07-01)

2026-07-19 16:00:18 +00:00

quick-start.md

fix(client): start reliably on Wayland; degrade PTT without X11

2026-07-19 10:50:10 +00:00

schema.md

feat(server,client): announcement channels (D1, closes A-2026-07-01)

2026-07-19 16:00:18 +00:00

security.md

docs: record final Tauri capability posture and residual risk

2026-07-20 14:51:23 +02:00

server-configuration.md

feat(server): support dual-homed voice hosts and user-managed livekit.yaml

2026-07-19 10:50:11 +00:00

tailscale.md

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00