week note: hardening and cleanup
2026-08-24
https://tinksoft.com/log/week-note-2026-08-24/
--------------------------------

Most of this week went into fixing known problems and removing weak defaults.
A few things shipped. One scanner patch is still under review.

## cybertoolbox

[CyberToolbox](https://github.com/tinkthemaker/CyberToolbox) gained an RFC
9116 `security.txt` auditor. The same pass closed DNS-rebinding and translated
IPv6 paths around the SSRF checks, bounded request bodies and rate-limit state,
and brought the production dependency audit back to zero findings.

The [hardening work](https://github.com/tinkthemaker/CyberToolbox/pull/8) is
merged. The test suite now covers the new network boundaries.

## sepulchrynscan

[SepulchrynScan](https://github.com/tinkthemaker/SepulchrynScan) is getting a
stricter authorization boundary. Scan targets must be a single IP, CIDR, or
hostname. Redirects cannot leave the approved scope. HTTP responses and Nmap
runs are bounded. Report data is escaped before it reaches an HTML script
block.

The [patch](https://github.com/tinkthemaker/SepulchrynScan/pull/1) is open. It
has 112 passing tests, but it is not merged yet.

## tping

[TPing](/projects/tping/) no longer starts a new sweep while the last one is
still running. That was the cause of rows staying unresolved after a stop and
restart. Sweeps now run in series, resume without losing a cycle, and display
packet loss as degraded instead of healthy.

## screech

[Screech v0.6.1](https://github.com/tinkthemaker/screech/releases/tag/v0.6.1)
is out. It adds normal help and version flags, refuses to start in a terminal
that is too small, and provides a reduced-motion option.

## fantasyreplace

[FantasyReplace](https://github.com/tinkthemaker/FantasyReplace) now has
`-dry-run` and `-check` modes. The first shows where output would go without
writing it. The second returns a failing status when input would change, which
makes it usable as a CI check.

That work is [merged](https://github.com/tinkthemaker/FantasyReplace/pull/1).

## tinksoft

This site moved from Vercel to GitHub Pages. I removed the guestbook, restored
the content security policy, rebuilt the NFO, rewrote the copy, and added a
page trail that always leads back to the post index.

That is enough for one week.