Remove SSH private keys from git, add SECRET_KEY validation, move WS auth from query string to first message, add session limits/idle timeout, PBKDF2 Fernet key, refresh token rotation, TOTP replay protection, file upload size limit + filename sanitization, symlink safety check, restrict CORS methods, IP-gate OpenClaw token, run container as non-root, rate-limit refresh/passkey endpoints, sanitize Gitea path params. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Rewrite terminal.py to use asyncssh instead of pty/fork - Add SSH key pair for dashboard container auth - Mount SSH key and add SSH config vars in docker-compose - Install openssh-client in Dockerfile - Add asyncssh to requirements.txt
Gan, Jimmy