Skip to content

great_cto

v2.78.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

agentic-coding claude-code-plugin claude-code-skills claude-code-subagents code-review cto
+2 more
multi-agent sdlc

Affected surfaces

auth rbac

Summary

AI summary

Structured logging added across server and scripts with zero‑dependency logger.

Full changelog

Quality deepened, prompts on a diet, structured logs

  • QUALITY-DEEPEN follow-ups #3–#6 (ARCH-quality-deepen-followups.md):
    archetype domain contracts extended 6 → 14 archetypes; contract regexes
    hardened against false positives (the /hold/-matches-"household" class);
    quality.mjs --gate --baseline (product-eval parity) and --trend
    (sparkline over metrics-history.jsonl); opt-in --browser harness with
    axe-core a11y + Web Vitals (LCP/CLS/INP) — dynamic playwright import,
    graceful na everywhere, runtime stays zero-dep.
  • Agent prompt dietarchitect.md 1181 → 827 lines, project-auditor.md
    1019 → 701 (−30% each): 16 embedded bash blocks extracted to scripts/*.sh,
    pricing/framework tables to skills/great_cto/references/, duplicate step
    numbering fixed, vestigial bd_create_if_new code removed. Cheaper every
    single agent invocation.
  • Structured logging — zero-dep leveled logger (GREAT_CTO_LOG_LEVEL,
    ISO timestamps, error→stderr) across the board server; script diagnostics
    routed through it; hook protocol and CLI user output untouched by design.
  • Board hardening — static path-traversal containment, origin-check dedupe,
    HOME-boundary for raw ?project= paths.
  • Telemetry endpoint — default now the documented telemetry.greatcto.systems
    (verified live); personal placeholder hostname removed.
  • Fixed the archetype-drift test failures (cli vs cli-tool) — main is fully
    green: lib suite 355, full suite 176, hooks 117.

Security Fixes

  • Board hardening: added static path‑traversal containment, origin‑check deduplication, and HOME‑boundary enforcement for `?project=` paths
  • Telemetry endpoint default changed to verified live `telemetry.greatcto.systems`; removed personal placeholder hostname

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track great_cto

Get notified when new releases ship.

Sign up free

About great_cto

Engineering-management layer of 34 specialist AI agents covering the full SDLC (architect, PM, senior-dev, reviewer, QA, security, devops, L3-support + 18 archetype-specific reviewers) with auto-detected archetypes and compliance gates (PCI-DSS, HIPAA, FedRAMP, GDPR, EU AI Act). Runs in Claude Code, Cursor, Codex CLI, Aider, and Continue via AGENTS.md + MCP. MIT.

All releases →

Related context

Earlier breaking changes

  • v2.72.2 Removes Autopilot sidebar item and Operate topbar button from dev board.
  • v2.55.0 Hard-gates the Build board; redirects invite sessions to Operate for operators.
  • v2.43.0 Runtime now blocks autonomous execution of irreversible actions without prior human checkpoint.
  • v2.43.0 Adds reversible and blastRadius fields to every flow step.
  • v2.32.0 Removed AgentShield scanner and its CLI commands.

Beta — feedback welcome: [email protected]