Hardening and Verification
Implemented defenses and honest limits on audit and release claims.
Current documentation baseline
This page describes the Core 2.5.7 / Interface 1.9.0 release set and Salesforce 0.3.0.1 release. It does not declare that every critical/high issue across every dependency and deployment has been eliminated.
Implemented defenses
- Core Event string/metadata validation and ICS input/resource bounds
- ICS URL/address checks, Node DNS validation and per-hop redirect checks
- State update protection against dangerous prototype keys
- Text-based event rendering and constrained color handling
- Bounded recurrence expansion and cache/resource cleanup
- Interface read-only interactions, stale-editor detection and explicit deletion confirmation
- Salesforce user-mode operations, sharing/context validation, native recurrence guards and tested Reader/Editor permission metadata
Each protects a specific boundary. URL checks do not replace egress controls; client read-only mode does not replace server authorization; passing tests does not establish full RFC, browser or accessibility coverage.
Verification still matters
The October package work includes automated Core/Interface/adapter checks and specific live Salesforce synthetic CRUD/date workflows. Salesforce 0.3.0.1 is promoted; installation into a production org is a separate action. An actual restricted-user browser session remains a rollout check. Application-exposed calendar tools need their own host authorization and persistence controls.
Core 2.5.7 corrects the V2 cross-host recurrence issue discovered during benchmarking. The scope and remaining timezone/override limits are explicit. Correctness results take precedence over performance comparisons.
Check the audit dashboard and repository CI for their date, commit and scope. An audit showing no known advisories at one time is not a guarantee that new advisories cannot appear.
Deployment checklist
Pin the tested release set, validate inputs at your host boundary, enforce authorization on every write, use bounded query/recurrence windows, keep credentials out of event content, and verify real CSP/LWS behavior in the target environment. Follow the security policy for reporting concerns.