- Require admin auth on interface-local-ip, network-interfaces,
next-listen-port and public-ip (interface-local-ip and public-ip
allowed unauthenticated command injection as root)
- Validate interface names and call ip/curl via execFileSync
- Write host/client WireGuard configs with fs instead of shell
heredocs, validating IPs, AllowedIPs, endpoint and listen port
- Replace rm -rf/cat/mkdir/chmod/test shell calls with fs APIs
- Refuse private media requested through the public media route
Co-Authored-By: Claude Opus 5.5 <[email protected]>
tben
