Skip to content

Navigation Menu

Appearance settings

View all features
- BY COMPANY SIZE
  Enterprises
  Small and medium teams
  Startups
  Nonprofits
- BY USE CASE
  App Modernization
  DevSecOps
  DevOps
  CI/CD
  View all use cases
- BY INDUSTRY
  Healthcare
  Financial services
  Manufacturing
  Government
  View all industries
View all solutions
- EXPLORE BY TOPIC
  AI
  Software Development
  DevOps
  Security
  View all topics
- EXPLORE BY TYPE
  Customer stories
  Events & webinars
  Ebooks & reports
  Business insights
  GitHub Skills
- SUPPORT & SERVICES
  Documentation
  Customer support
  Community forum
  Trust center
  Partners
View all resources
- COMMUNITY
  GitHub SponsorsFund open source developers
- PROGRAMS
  Security Lab
  Maintainer Community
  Accelerator
  GitHub Stars
  Archive Program
- REPOSITORIES
  Topics
  Trending
  Collections
- ENTERPRISE SOLUTIONS
  Enterprise platformAI-powered developer platform
- AVAILABLE ADD-ONS
  GitHub Advanced SecurityEnterprise-grade security features
  Copilot for BusinessEnterprise-grade AI features
  Premium SupportEnterprise-grade 24/7 support
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

ScriptSmith / hadrian Public

Notifications You must be signed in to change notification settings
Fork 0
Star 1

Code
Issues
Pull requests 1
Discussions
Actions
Projects
Security and quality
Insights

Additional navigation options

Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights

Review fixes#32

Merged

ScriptSmith merged 172 commits intomainScriptSmith/hadrian:mainfrom

review-fixesScriptSmith/hadrian:review-fixesCopy head branch name to clipboard

Apr 28, 2026

Conversation Commits172 (172)Checks Files changed

Merged

Review fixes#32
ScriptSmith merged 172 commits intomainfrom
review-fixes

Commits

Commits on Apr 25, 2026

Enable foreign_keys pragma on SQLite native pool
ScriptSmith
committed
Wire Postgres pool config (timeouts and ssl mode)
ScriptSmith
committed
Attach ConnectInfo to axum service for client IP extraction
ScriptSmith
committed
Use safe prefix strip helper for Anthropic stream IDs
ScriptSmith
committed
Use /health/live for liveness and /health/ready for readiness
ScriptSmith
committed
Tighten OAuth callback loopback check and strip duplicate code param
ScriptSmith
committed
Pin OpenAPI info.version to CARGO_PKG_VERSION
ScriptSmith
committed
Stop swallowing cargo audit failures in CI scripts
ScriptSmith
committed
Reject empty JWT and proxy audience values at config load
ScriptSmith
committed
Disallow space character in model string validation
ScriptSmith
committed
Return first routing error rather than last on fallback failure
ScriptSmith
committed
Match HADRIAN_TEST_DEBUG on value not env presence
ScriptSmith
committed
Validate SAML metadata URL against SSRF in parse endpoint
ScriptSmith
committed
Validate image URL against SSRF before fetching
ScriptSmith
committed
Strip reserved underscore-prefixed roles from bearer and proxy auth
ScriptSmith
committed
Hide cross-user session existence in delete endpoint
ScriptSmith
committed
Send Vertex API key via header instead of URL query
ScriptSmith
committed
Use VecDeque for SSE stream output buffers to avoid O(n) shifts
ScriptSmith
committed
Use parking_lot RwLock in CircuitBreakerRegistry to drop poison panic
ScriptSmith
committed
Add noopener to OpenRouter OAuth iframe escape window.open
ScriptSmith
committed
Reject protocol-relative return_to values on login redirect
ScriptSmith
committed
Redact auth token from AccountPage data export
ScriptSmith
committed
Clamp ListQuery limit to a hard maximum of 1000
ScriptSmith
committed
Sanitize CSV export cells to defang formula injection
ScriptSmith
committed
Route citation links through parent URL handler for safety modal
ScriptSmith
committed
Default audit log list to last 7 days when no range given
ScriptSmith
committed
Validate DLQ table_name as identifier before interpolating
ScriptSmith
committed
Mark selected conversation with aria-current for screen readers
ScriptSmith
committed
Log SSE event parse errors instead of silently swallowing
ScriptSmith
committed
Wrap clipboard writes in try/catch to surface failures
ScriptSmith
committed
Debounce and memoise conversation list filter to avoid O(N*M) hitches
ScriptSmith
committed
Stop forcing inflated virtualizer height in ChatMessageList
ScriptSmith
committed
Broadcast post-update conversation snapshot to other tabs
ScriptSmith
committed
Compare feedback historyMode and modeMetadata in memo equality
ScriptSmith
committed
Apply nightly rustfmt to review-fixes changes
ScriptSmith
committed
Reject session cookie secure=false with SameSite=None
ScriptSmith
committed
Preserve SSE event terminator when injecting cost
ScriptSmith
committed
Estimate SSE delta tokens by char count, not byte len
ScriptSmith
committed
Pin React Query mutations retry to 0
ScriptSmith
committed
Use form's isSubmitting on LoginPage to prevent double-submit
ScriptSmith
committed
Make OIDC/SAML auth_state TTL configurable via SessionConfig
ScriptSmith
committed
Only strip Content-Length when cost injection rewrites body
ScriptSmith
committed
Surface unknown OAuth owner kind instead of coercing to user
ScriptSmith
committed
Cancel useAutoScroll rAF on unmount to avoid stale scheduled callback
ScriptSmith
committed
Roll back optimistic pin reorder on sync failure
ScriptSmith
committed
Cache shiki HTML so theme toggles reuse prior highlights
ScriptSmith
committed
Replace 50-char prefix sync hash with djb2 over full content
ScriptSmith
committed
Accept pasted images in ChatInput textarea
ScriptSmith
committed
Broadcast useLocalStorage writes to same-tab hook instances
ScriptSmith
committed
SSRF-validate per-org OIDC redirect_uri on create and update
ScriptSmith
committed
Abort in-flight title generation when ConversationsProvider unmounts
ScriptSmith
committed
Scope API-key revoke/rotate authz by owner org/team/project
ScriptSmith
committed
Gate admin-UI bypass on explicit VITE_FORCE_ADMIN_ACCESS env flag
ScriptSmith
committed
Cancel superseded CEL validation requests with AbortController
ScriptSmith
committed
Skip HTTPS image preprocessing for providers that pass through
ScriptSmith
committed
Wire DataTable filtered row model unconditionally
ScriptSmith
committed
Prefer configured public_url for SCIM base URL
ScriptSmith
committed
Replace per-token Markdown pre-tagging with MutationObserver
ScriptSmith
committed
Generate a session secret in wizard-rendered IdP configs
ScriptSmith
committed
Validate branding colors, fonts, and favicon URL before injecting
ScriptSmith
committed
Record cache_operation error metric on semantic-match lookup failure
ScriptSmith
committed
Drop inner stream when IdleTimeoutStream times out to release upstream resources
ScriptSmith
committed
Skip primary payload clone when no fallback chain is configured
ScriptSmith
committed
Strip provider error detail from client responses; keep raw text in logs
ScriptSmith
committed
Move shutdown timeouts and JWT loader concurrency to ServerConfig
ScriptSmith
committed
Bound AWS credential-refresh notify_waiters wait to avoid stuck waiters
ScriptSmith
committed
Drain provider stream transformers in a loop instead of self-waking
ScriptSmith
committed
Probe /auth/me for header auth so non-admin users authenticate cleanly
ScriptSmith
committed
Confine FilesystemFileStorage I/O to the configured root via canonicalize
ScriptSmith
committed
Pin audit-log list org_id to caller's org membership
ScriptSmith
committed
Pass requested owner scope into skills/templates create authz check
ScriptSmith
committed
Delete orphaned files from external storage before removing DB rows
ScriptSmith
committed
Walk caller's memberships in user_has_access instead of paging through resource members
ScriptSmith
committed
Bound Kreuzberg document extraction with configurable timeout
ScriptSmith
committed
Use partial unique index so soft-deleted vector_store_files don't block re-add
ScriptSmith
committed
Surface UUID parse errors in service_accounts revoke instead of dropping rows
ScriptSmith
committed
Combine DLQ count and delete into a single statement to fix TOCTOU
ScriptSmith
committed
Route MCPUIRenderer default link clicks through trusted-domain modal
ScriptSmith
committed
Accept optional zod schema in useLocalStorage to validate cross-tab writes
ScriptSmith
committed
Replace per-token streaming aria-live with hidden status region announcement
ScriptSmith
committed
Add hidden streaming status region to MultiModelResponse for screen readers
ScriptSmith
committed
Spawn static models cache warm after listener bind so it doesn't block startup
ScriptSmith
committed
Reject empty error.message and error.type in assert_error helper
ScriptSmith
committed
Panic with raw body when provider e2e response isn't valid JSON
ScriptSmith
committed
Add SSRF validation and issuer pinning to OIDC discovery
ScriptSmith
committed
Strip reserved-prefix roles from OIDC and SAML session claims
ScriptSmith
committed
Honor real OAuth token expiry in Vertex token caching
ScriptSmith
committed
Drop bespoke IPv4/IPv6 form validators; rely on backend IpNet parser
ScriptSmith
committed
Make Anthropic interleaved-thinking model allowlist configurable
ScriptSmith
committed
Re-scope DLQ retry authz to the queued entry's tenant fields
ScriptSmith
committed
Cap accumulated reasoning and text content in stream state
ScriptSmith
committed
Pin Dockerfile builder to stable Rust 1.90 and set MSRV
ScriptSmith
committed
Replace startup unwrap/expect with structured exit and bump MSRV to 1.91
ScriptSmith
committed
Fail closed when IAP is configured without trusted_proxies
ScriptSmith
committed
Log a startup error when ignored TLS config is present
ScriptSmith
committed
Regenerate Hadrian OpenAPI spec in CI before conformance check
ScriptSmith
committed
Set terminationGracePeriodSeconds=60 in Helm to fit 35s drain
ScriptSmith
committed
Validate chat completion content, usage, and model echo in shared test
ScriptSmith
committed

Commits on Apr 26, 2026

Throttle bootstrap admin auth per IP to deter key guessing
ScriptSmith
committed
Throttle /auth/discover separately to deter SSO domain enumeration
ScriptSmith
committed
Make DLQ pop atomic via DELETE...RETURNING with row locking
ScriptSmith
committed
Bind RFC-3339 timestamps in SQLite repos and grep-guard regressions
ScriptSmith
committed
Scope response/semantic cache keys and vector search by tenant
ScriptSmith
committed
Burn OAuth code after repeated PKCE verifier failures
ScriptSmith
committed
Pepper SCIM bearer token hashes with HMAC-SHA256
ScriptSmith
committed
Drop unused daily_spend table and its retention plumbing
ScriptSmith
committed
Sandbox HTML artifact open-in-new-tab in unique-origin iframe
ScriptSmith
committed
Add bash-style ${VAR:-default} fallback syntax for env-var expansion
ScriptSmith
committed
Stack modal focus traps and inert background under stacked dialogs
ScriptSmith
committed
Centralize error toast formatting via formatApiError helper
ScriptSmith
committed
Scope admin authz to row owner instead of all-None tuples
ScriptSmith
committed
Delegate SPA OIDC logout to backend instead of fragile URL rewrite
ScriptSmith
committed
Add integration tests covering the OAuth PKCE redeem path
ScriptSmith
committed
Namespace inline-edit keys to avoid chat/multi-model collision
ScriptSmith
committed
Wrap chat tree in ErrorBoundary for recoverable render-time crashes
ScriptSmith
committed
Replace ad-hoc SSE line split with spec-compliant SseParser
ScriptSmith
committed
Tighten service-worker bootstrap to avoid races and stranger SWs
ScriptSmith
committed
Cache matchSkills result so slash popover does one scan per keystroke
ScriptSmith
committed
Stop dropdown mouseenter from stealing focus during keyboard nav
ScriptSmith
committed
Stop useChat from subscribing to entire streaming/debug stores
ScriptSmith
committed
Abort streams and epoch-tag commits on conversation switch
ScriptSmith
committed
Stop retrying body errors so we don't double-bill on partial uploads
ScriptSmith
committed
Dedupe fallback chain, cap length, and re-check CB per hop
ScriptSmith
committed
Drain usage logs through bounded channel instead of spawning from Drop
ScriptSmith
committed
Default CSP to strict preset; opt into permissive for WASM features
ScriptSmith
committed
Per-route body limits for audio transcription and file uploads
ScriptSmith
committed
Lazy-load KaTeX CSS so it stays out of the initial bundle
ScriptSmith
committed
Make OTEL trace test actually verify gateway spans reach Jaeger
ScriptSmith
committed
Type recharts tooltip payloads instead of disabling no-explicit-any
ScriptSmith
committed
Honor standard OTEL env vars so Helm-set OTLP endpoint actually exports
ScriptSmith
committed
Add hadrian healthcheck subcommand and drop curl from Docker image
ScriptSmith
committed
Make CommandPalette announce as a combobox with active-descendant listbox
ScriptSmith
committed
Add 24h TTL to API-key auth stored in localStorage
ScriptSmith
committed
Use Postgres advisory lock so cleanup workers run on one replica per tick
ScriptSmith
committed
Skip deserialize round-trip in ConversationsProvider setConversations
ScriptSmith
committed
Add per-IP rate limit and LRU eviction to GatewayJwtRegistry lazy-load
ScriptSmith
committed
Add pytest tests for openapi-conformance script resolver and checker
ScriptSmith
committed
Use aggregate count queries in access-review summary instead of per-user loop
ScriptSmith
committed
Switch samael from git pin to crates.io 0.0.20 and deny unknown-git
ScriptSmith
committed
Lazy-load vega-embed so chart runtime is split out of main bundle
ScriptSmith
committed
Add SR-only table and aria-label to recharts wrappers and SimpleBarChart
ScriptSmith
committed
Reassemble streaming deltas and assert non-empty content in provider e2e tests
ScriptSmith
committed
Exercise Hadrian DLQ admin endpoints instead of redis-cli stream commands
ScriptSmith
committed
Make admin-api-crud tests order-independent via beforeAll and scratch teams
ScriptSmith
committed
Add opt-in urlStateKey to DataTable for deep-linkable filter and pagination
ScriptSmith
committed
Add OpenAPI annotations for /auth/me and /auth/discover
ScriptSmith
committed
Add ChatPage smoke story with mocked providers and msw handlers
ScriptSmith
committed
Pre-fetch owner scope for /api-keys/:id/usage and /users/:id/usage authz
ScriptSmith
committed
Pin reqwest DNS to validated SSRF addrs and stream image body cutoff
ScriptSmith
committed
Refuse startup when [server.tls] is set without acknowledge_unsupported
ScriptSmith
committed
Explicitly pg_advisory_unlock LeaderGuard on Drop with detach fallback
ScriptSmith
committed
Gate api-key revoke/rotate NotFound behind unscoped authz to close oracle
ScriptSmith
committed
Make SCIM token pepper mandatory and require [auth.session].secret
ScriptSmith
committed
Arm AWS credential refresh notified() before CAS to avoid missed-wakeup
ScriptSmith
committed
Add interleaved_thinking_models allowlist to Bedrock provider
ScriptSmith
committed
Pin audit-log list to caller's single org membership
ScriptSmith
committed
Move list limit clamp into ListParams::clamp on construction
ScriptSmith
committed
Tenant-scope DLQ get/delete/retry via entry_authz_scope helper
ScriptSmith
committed
Coalesce useStreamingStore appendContent into one setState per rAF
ScriptSmith
committed
Defer lone trailing CR in SseParser to handle CRLF split across chunks
ScriptSmith
committed
Use OsRng directly for wizard-generated session secret
ScriptSmith
committed
Drop rust-version pin and bump Dockerfile to rust:1.95.0-slim
ScriptSmith
committed
Fix formatting
ScriptSmith
committed
Fix build
ScriptSmith
committed
Fix bug with initial conversation
ScriptSmith
committed
Review fixes
ScriptSmith
committed

Commits on Apr 27, 2026

Build fixes
ScriptSmith
committed
Fix unit tests
ScriptSmith
committed
Fix e2e tests
ScriptSmith
committed

Commits on Apr 28, 2026

Fix chart
ScriptSmith
committed
Address tar vuln
ScriptSmith
committed
Fix WebSocket race condition
ScriptSmith
committed

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.