Jonathan Kirkwood 3c7094241c 0.2.41: contain SPA static serving to the web root ...

Percent-encoded traversal (..%2f) survived routing and let an
unauthenticated request read files outside static/, including the
database and session secret on the data volume. Paths are now resolved
and contained to the frontend build directory; anything that escapes
falls back to index.html.

2026-08-10 15:38:21 -05:00

..

index.ts

0.2.41: contain SPA static serving to the web root

2026-08-10 15:38:21 -05:00

v_0_1_0.ts

Issue 17: StartOS 0.4.0 packaging

2026-06-07 19:23:26 +00:00

v_0_2_0.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_1.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_3.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_4.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_5.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_6.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_7.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_8.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_9.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_10.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_11.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_12.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_13.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_14.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_15.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_16.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_17.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_18.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_19.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_20.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_21.ts

Release 0.2.21; track the StartOS version files

2026-07-01 13:39:56 -05:00

v_0_2_22.ts

Release 0.2.22: capital chart, Investor View, GP stakes, doc folders

2026-07-01 14:25:50 -05:00

v_0_2_23.ts

0.2.23: link GP entities to their investor account for auto asset balances

2026-07-01 15:21:28 -05:00

v_0_2_24.ts

0.2.24: household-aware GP asset balances + show on Overview

2026-07-01 16:14:58 -05:00

v_0_2_25.ts

0.2.25: batch historical eNAV backfill + collapsible investor chart

2026-07-01 18:47:01 -05:00

v_0_2_26.ts

0.2.26: security hardening from audit (P2/P3 fixes)

2026-07-01 19:09:27 -05:00

v_0_2_27.ts

0.2.27-0.2.32: LP portal polish, brand palette, default investor logins

2026-07-03 08:40:40 -05:00

v_0_2_28.ts

0.2.27-0.2.32: LP portal polish, brand palette, default investor logins

2026-07-03 08:40:40 -05:00

v_0_2_29.ts

0.2.27-0.2.32: LP portal polish, brand palette, default investor logins

2026-07-03 08:40:40 -05:00

v_0_2_30.ts

0.2.27-0.2.32: LP portal polish, brand palette, default investor logins

2026-07-03 08:40:40 -05:00

v_0_2_31.ts

0.2.27-0.2.32: LP portal polish, brand palette, default investor logins

2026-07-03 08:40:40 -05:00

v_0_2_32.ts

0.2.27-0.2.32: LP portal polish, brand palette, default investor logins

2026-07-03 08:40:40 -05:00

v_0_2_33.ts

0.2.33: exited positions (secondary-sale edge case)

2026-07-03 08:54:19 -05:00

v_0_2_34.ts

0.2.34: manage exited status from the Capital Accounts view

2026-07-03 09:03:49 -05:00

v_0_2_35.ts

0.2.35: exited positions show history clipped at the exit date

2026-07-03 09:23:47 -05:00

v_0_2_36.ts

0.2.36: Investor View carries exit status + grey out fully-exited fund cards

2026-07-03 09:35:03 -05:00

v_0_2_37.ts

0.2.37: live funds above exited ones in the investor portal

2026-07-03 12:07:05 -05:00

v_0_2_38.ts

0.2.38: optional two-factor authentication (authenticator-app TOTP)

2026-07-11 22:08:04 +02:00

v_0_2_39.ts

0.2.39: bitcoin-denominated view, first-login flow, unfunded + tax center

2026-07-12 13:01:50 +02:00

v_0_2_40.ts

0.2.40: bitcoin-denominated line on the LP capital chart

2026-07-14 09:10:14 +02:00

v_0_2_41.ts

0.2.41: contain SPA static serving to the web root

2026-08-10 15:38:21 -05:00