Skip to content

kastelldev/kastell

v1.2.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 2mo Server & OS Management
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

automation cli coolify devops digitalocean docker
+10 more
dokploy hetzner linode mcp security-audit self-hosted server-management typescript vps vultr

Affected surfaces

auth

Summary

AI summary

stripSensitiveData() now fully sanitizes error responses and headers to prevent API token and root password leakage.

Full changelog

Security

  • CRITICAL FIX: stripSensitiveData() now sanitizes error.response.data and error.response.headers — prevents API tokens, rootPass, and other sensitive data from leaking via error cause chains
    • Whitelist-based sanitizeResponseData() preserves only known error message fields (Hetzner error.message, DigitalOcean message, Vultr error, Linode errors[].reason)
    • Response headers cleared to prevent set-cookie and tracking header exposure
    • Linode root_pass reflection in error responses now stripped

Changed

  • Refactoring: Extracted init.ts command logic into src/core/deploy.ts (619 → 243 lines)
  • Refactoring: PROVIDER_REGISTRY centralized in src/constants.ts — single source of truth for provider metadata
  • Refactoring: stripSensitiveData() consolidated from 4 provider files into src/providers/base.ts
  • Security: SCP path hardening via assertSafePath() with shell metacharacter rejection
  • Security: Token sanitization via sanitizedEnv() applied to all remaining child process calls
  • Test count: 2,047 → 2,099 (+52 new tests)
  • Test suites: 76 → 78 (+2 new suites)

Security Fixes

  • `stripSensitiveData()` sanitizes `error.response.data` and `error.response.headers`, removing API tokens, root passwords, and other sensitive data from error cause chains.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track kastelldev/kastell

Get notified when new releases ship.

Sign up free

About kastelldev/kastell

Server security auditing and hardening toolkit. 413 security checks across 29 categories (SSH, Firewall, Docker, TLS, HTTP Headers), CIS/PCI-DSS/HIPAA compliance mapping, 19-step production hardening, fleet management, and forensic evidence collection. Supports Hetzner, DigitalOcean, Vultr, and Linode. 13 MCP tools.

All releases →

Related context

Beta — feedback welcome: [email protected]