AthenaandCursor fe12eb1821 feat(security): bind services to loopback with Host + CORS allowlists ...

The Synapse backend and memory service bound 0.0.0.0 with wildcard CORS and no
auth, exposing the full unauthenticated admin/data API to the LAN. Default the
uvicorn bind to 127.0.0.1 (NEXUS_BIND_HOST override), scope CORS to known local
origins instead of "*", and add TrustedHostMiddleware to reject foreign Host
headers (which defeats DNS-rebinding, something same-origin CORS cannot stop).

NEXUS_ALLOWED_HOSTS / NEXUS_ALLOWED_ORIGINS allow opt-in LAN exposure, intended
to be paired with real authentication.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-08-07 09:40:12 -05:00

..

autostart

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

panel

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

sessions

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

controlpanel.py

feat: put ncp on PATH on both platforms; rename WSL reqs to Windows

2026-07-22 14:11:18 -05:00

ncp.cmd

fix: delete management/ncp.ps1 - it shadowed the ncp.cmd PATH shim

2026-07-22 14:59:56 -05:00

ncp.py

feat(security): bind services to loopback with Host + CORS allowlists

2026-08-07 09:40:12 -05:00

nexus_api.py

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

nexus-app.sh

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

nexus-cli.sh

fix: delete management/ncp.ps1 - it shadowed the ncp.cmd PATH shim

2026-07-22 14:59:56 -05:00

nexus-control-panel.desktop

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

test_controlpanel_close.py

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00

test_nexus_api.py

Initial commit: NexusOS - local AI assistant platform

2026-07-21 22:48:38 -05:00