v0.3.1: security audit fixes — trust boundary (ADR-016), detector hardening, chainId, L2 fail-secure - #8

Merged

Lykhoyda merged 16 commits into

mainfrom

Jun 14, 2026

Commits on Apr 21, 2026

feat(popup)+chore(release): expandable Recent Activity + v0.3.0 bundle
Lykhoyda
committed
4f5b0c2
polish(popup): forensic-log aesthetic for Recent Activity details
Lykhoyda
committed
d1dc53d
docs(readme): use SVG source icon instead of PNG
Lykhoyda
committed
53ac8eb
chore(build): auto-load .env.local for TESTUDO_API_KEY / TESTUDO_API_URL
Lykhoyda
committed
7ac790c
fix(messaging): eliminate TDZ in sendTestudoRequest when response is sync
Lykhoyda
committed
fcb135b

Commits on Jun 8, 2026

chore(release): bundle v0.3.1 — version bump + store zip + release log

Lykhoyda
and
claude
committed
cf3762f
fix(core): require corroboration in detectEcrecover to close drainer bypass (AUDIT-3)

Lykhoyda
and
claude
committed
4e22936
fix(extension): MessagePort bridge + MAIN-world content script (ADR-016, AUDIT-1/2)

Lykhoyda
and
claude
committed
73b9b3d
docs: log 48 audit findings + trust-boundary v2 decision/roadmap

Lykhoyda
and
claude
committed
c254eda
fix(extension): parse decimal-string chainId correctly (AUDIT-4/11/30)

Lykhoyda
and
claude
committed
8042890
fix(extension): fail-secure off-mainnet bytecode/deployer analysis (AUDIT-5/26)

Lykhoyda
and
claude
committed
7df2c20
test(extension): guard bloom round-trip at non-byte-aligned size; refute AUDIT-6

Lykhoyda
and
claude
committed
2ea695a
docs: record HIGH-findings resolution (AUDIT-4/5/6/11/26/29/30)

Lykhoyda
and
claude
committed
d2bec58

Commits on Jun 9, 2026

merge: origin/main into release/v0.3.0 (resolve to v0.3.1 + ADR-016 state)

Lykhoyda
and
claude
committed
2e73928

Commits on Jun 14, 2026

chore(release): drop committed store zip; build it in CI instead (Codex PR #8 P1)

Lykhoyda
and
claude
committed
298cabb
merge: origin/main into release/v0.3.0 (post-gate; resolve conflicts)

Lykhoyda
and
claude
committed
6186225