The validate_slug() RFC-1123 regex is the sole remediation. The
set -f "two-layer defence" description was inaccurate — set -f is
not present in promote-tenant-image.sh on main. Corrects per
technical-writer review guidance on docs#51.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
docs#40 is closed; the tutorial file is now on docs#46's branch.
Updated the entry to reference docs#46 and mention the Kubernetes
terminationGracePeriodSeconds fix.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds molecule-core#933 (OFFSEC-006, CWE-918 SSRF + token exfiltration)
to the 2026-05-14 Security section in changelog.mdx.
Also adds OFFSEC-006 to the Security Changelog (security/changelog.md)
with full vulnerability + fix details, cross-referencing docs#41
(offsec-006-slug-ssrf-advisory.mdx) which will add the full
advisory page when it merges.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Day 2026-05-15 begins with no merged PRs (cron fired at 02:15 UTC;
entry will be populated at 23:50 UTC when the day is finalised).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds the openclaw workspace template models-in-runtime_config bug fix
to today's changelog alongside the existing CWE-78 + OFFSEC-003 entries.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds the workspace-side OFFSEC-003 hardening entry to the 2026-05-14
changelog section already opened in docs#45.
Changes:
- changelog.mdx: OFFSEC-003 workspace boundary escaping + closer truncation
added to the 2026-05-14 security section alongside CWE-78 entry
Note: core#1075 (OFFSEC-010 symlink in provisioner) is SaaS-only
provisioner detail — no public docs needed.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Pairs molecule-core#1030 (Critical). Restores POSIX shell-identifier
guard in expandWithEnv(org_helpers.go:82) that was inadvertently
removed during a regression window. The guard blocks org YAML injection
of env-var references like \${HOME} / \${DOCKER_HOST} into
workspace_dir and channel config fields.
Changes:
- security/changelog.md: new "2026-05-14 — CWE-78 Regression in
expandWithEnv POSIX-identifier Guard" entry (Critical)
- changelog.mdx: new "2026-05-14" section with security + bugfix entries
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Molecule AI App & Docs Lead
technical-writer
app-lead
documentation-specialist