openhands 818df3697b Migrate from AES-256-CBC to AES-256-GCM for authenticated encryption ...

- Replace CBC+HMAC with GCM (built-in authentication via authTag)
- Remove createHmac and timingSafeEqual imports (no longer needed)
- Remove Snyk-ignore comments (no longer suppressible findings)
- Update test: tampered MAC test -> tampered auth tag test
- Add one-time migration script for existing CBC-encrypted 2FA secrets

2026-07-10 23:51:56 +02:00

..

apply-migrations.ts

Security hardening, code quality, and ESLint setup

2026-07-10 22:48:22 +02:00

jobs-worker.ts

fix: production hardening — migration script, security fixes, structured logging, API docs, component splitting

2026-07-08 13:06:02 +02:00

migrate-aes-cbc-to-gcm.ts

Migrate from AES-256-CBC to AES-256-GCM for authenticated encryption

2026-07-10 23:51:56 +02:00

tsconfig.json

fix: production hardening — migration script, security fixes, structured logging, API docs, component splitting

2026-07-08 13:06:02 +02:00