fix(selfhost): hide Postgres backup credentials - #2459

Merged

JSONbored merged 6 commits into

mainfrom

codex/propose-fix-for-postgres-backup-vulnerability

Jul 2, 2026

Commits on Jul 2, 2026

fix(selfhost): hide Postgres backup credentials
JSONbored
committed
5fe2c53
fix(selfhost): stop dropping the query string from the Postgres backup URL
JSONbored
committed
71b01b6
fix(selfhost): reject a newline/CR in the decoded backup password
JSONbored
committed
8638acb
fix(selfhost): stop scanning the whole URL for userinfo, only the authority
JSONbored
committed
3f0cb28
fix(selfhost): strip a password supplied via the libpq query-string form too
JSONbored
committed
99c2234
fix(selfhost): strip every occurrence of a repeated query-string password
JSONbored
committed
3aac594