Most of this week went into fixing known problems and removing weak defaults. A few things shipped. One scanner patch is still under review.
cybertoolbox
CyberToolbox gained an RFC
9116 security.txt auditor. The same pass closed DNS-rebinding and translated
IPv6 paths around the SSRF checks, bounded request bodies and rate-limit state,
and brought the production dependency audit back to zero findings.
The hardening work is merged. The test suite now covers the new network boundaries.
sepulchrynscan
SepulchrynScan is getting a stricter authorization boundary. Scan targets must be a single IP, CIDR, or hostname. Redirects cannot leave the approved scope. HTTP responses and Nmap runs are bounded. Report data is escaped before it reaches an HTML script block.
The patch is open. It has 112 passing tests, but it is not merged yet.
tping
TPing no longer starts a new sweep while the last one is still running. That was the cause of rows staying unresolved after a stop and restart. Sweeps now run in series, resume without losing a cycle, and display packet loss as degraded instead of healthy.
screech
Screech v0.6.1 is out. It adds normal help and version flags, refuses to start in a terminal that is too small, and provides a reduced-motion option.
fantasyreplace
FantasyReplace now has
-dry-run and -check modes. The first shows where output would go without
writing it. The second returns a failing status when input would change, which
makes it usable as a CI check.
That work is merged.
tinksoft
This site moved from Vercel to GitHub Pages. I removed the guestbook, restored the content security policy, rebuilt the NFO, rewrote the copy, and added a page trail that always leads back to the post index.
That is enough for one week.