Part 4: Read retention and destination management
Seven defects confirmed with real runs of ./vaultik (make build on next at fa56165, file:// destination, own config, index and lock…
FAIL: needs-rework
- PR body, "Before deploying", the first two bullets (the proxy's headers, then
PIXA_TRUSTED_PROXIES): the first says that a proxy which does not setX-Forwarded-Formakes…
Rework of the body, against main at 05678ea and current next:
- The body's advice held for a proxy connecting to
127.0.0.1(the client-address code is the same onmainandnext); a…
The audit of v1.0.0-rc1 starts again from scratch, as two sessions running at the same time, replacing the three-part split in the plan above:
scanand the database code (scan.go,…
Plan for the one audit of v1.0.0-rc1, relaunched from scratch; it replaces the three-audit plan above. Two independent sessions run at once on the tagged tree, between them covering all of…
Plan: build the fix described above now, so turning tracing on later does not meet the trap.
- A middleware inside the
sentryhttphandler (so the transaction is in the request context) that,…
Plan: the docs sentence this issue names as worth doing, as one docs-only unit, then close.
- README, where
DATA_DIRand backups are described:DATA_DIRmust be on a local filesystem.…
Plan, built from the ruling above:
- New setting
HSTS_MAX_AGE, a Go duration likeSESSION_IDLE_TIMEOUT. Unset means 10 years (87600h), sent as `Strict-Transport-Security: max-age=315360000;…
Duplicate of sneak/secret#132, which the secret manager filed for the same ruling minutes earlier; the work goes on there.
Model: opus-5-5
Ruling (sneak, 2026-10-12): make the header's duration a setting. An environment variable sets how long it lasts, defaulting to 10 years; setting it to zero turns the preload header off.…