Go to file

marcuspaico 0b0f81b7bb fix(auth): global login rate limit — XFF was spoofable and Map unbounded

The login rate limiter keyed on the client-controlled x-forwarded-for
header, letting an attacker rotate XFF for unlimited password guesses
while also growing the failures Map unboundedly (memory DoS). Since
this is a single-password instance, replace with one global
{count, resetAt} tracker per app instance: check the 15-min window and
reject at >=10 failures before verifying the password, increment on
failure, reset on success.

2026-08-17 14:34:08 -07:00

.gitea/workflows

feat(deploy): serve SPA from server, Dockerfile, compose, deploy docs

2026-08-17 14:23:29 -07:00

docs

feat(deploy): serve SPA from server, Dockerfile, compose, deploy docs

2026-08-17 14:23:29 -07:00

server

fix(auth): global login rate limit — XFF was spoofable and Map unbounded

2026-08-17 14:34:08 -07:00

shared

feat(settings): LLM config API with AES-GCM sealed key, masked reads

2026-08-17 14:14:53 -07:00

web

feat(web): SPA shell — gate, settings, today placeholder

2026-08-17 14:18:05 -07:00

.dockerignore

fix: 404 unknown API routes, add .dockerignore

2026-08-17 14:27:15 -07:00

.gitignore

fix: typecheck without emit, placeholder test, drop build artifacts

2026-08-17 14:02:12 -07:00

bun.lock

feat(web): SPA shell — gate, settings, today placeholder

2026-08-17 14:18:05 -07:00

docker-compose.yml

feat(deploy): serve SPA from server, Dockerfile, compose, deploy docs

2026-08-17 14:23:29 -07:00

Dockerfile

feat(deploy): serve SPA from server, Dockerfile, compose, deploy docs

2026-08-17 14:23:29 -07:00

LICENSE

chore: monorepo scaffold, CI, MIT license

2026-08-17 13:55:39 -07:00

package.json

fix: typecheck uses -p (non-composite projects)

2026-08-17 14:21:07 -07:00

README.md

chore: monorepo scaffold, CI, MIT license

2026-08-17 13:55:39 -07:00

tsconfig.base.json

fix: typecheck without emit, placeholder test, drop build artifacts

2026-08-17 14:02:12 -07:00

README.md

Helios

Self-hosted, open-source health companion — a FOSS alternative to closed "24/7 AI health companion" products. Your data stays on your server; the AI runs on a key you provide (OpenRouter, or Ollama for zero third parties).

Status: pre-alpha scaffold. See docs/superpowers/specs/ for the design.

Develop

bun install
bun run typecheck && bun test