Patch notes: Private and unlisted recordings' thumbnails…

What shipped on OpenVibe from 2026-09-26 to 2026-09-27: 34 changes to OpenVibe.Host, OpenVibe.Chat, OpenVibe.Community, OpenVibe.Events, OpenVibe.Live, OpenVibe.Media and 3 more. Every line below is a commit message from the OpenVibers repositories, linked to the change itself.

Highlights

OpenVibe.Media: Private and unlisted recordings' thumbnails are no longer listed on the media index (roadmap WS-R task 5; high): the Thumbnails tab of / and /browse listed every file in the thumbnails directory, so a frame of every private or unlisted VOD… (385416d)
OpenVibe.Chat: Detaching a room says nothing to someone who may not (roadmap WS-R task 5: IDOR; low). A member who is not the room's manager got { removed: false } for an attachment that does not exist and 403 for one that does, so they could tell where… (9133c44)
OpenVibe.Community: IDOR suite (roadmap WS-R task 5: nobody acts on someone else's things by swapping ids). test/security-idor.test.js: alex owns a public, a private and a screenshot paste, paste comments, a thread with a reply, a typed comment, an uploaded… (7e22a51)
OpenVibe.Host: browser-watch: a release is judged once its process has run 3 minutes (/release.json booted_at), and the confirming second run of a failure waits a minute first. On 2026-09-26 a check minutes after a Live restart failed on 4 console errors… (87bca98)
OpenVibe.Network: gitleaks allowlist for the SSRF suite's web-push test vector (roadmap WS-R task 5). test/security-ssrf.test.js subscribes with the public example subscription from the web-push documentation; its auth value matches the generic-api-key… (a7e07f7)
OpenVibe.Events: Private-bypass suite, and an app token is never a realtime service viewer (roadmap WS-R task 5: private bypass; low). test/security-private.test.js publishes public, internal and per-person subject events and app events in two projects and… (2ad3f53)
OpenVibe.Live: Security crawl for stream keys and secrets (roadmap WS-R task 5: stream-key exposure, internal-secret leak). test/security-crawl.js boots the real server/index.js as a restore-drill instance (reads only, no outbound connection) on a seeded… (1734f3e)

OpenVibe.Host

openvibe.host · repository

Incident, maintenance and DNS controls (roadmap WS-N task 12; Contracts v0.66.0, pinned from 0.62.0). ovhost incident open|update|list and maintenance schedule|start|complete post to openvibe.network/status with Host's token… (59c31fe)
browser-watch: a release is judged once its process has run 3 minutes (/release.json booted_at), and the confirming second run of a failure waits a minute first. On 2026-09-26 a check minutes after a Live restart failed on 4 console errors… (87bca98)
browser-watch keeps what failed: per route, the axe rule ids with up to 3 targets, the first console errors, overflow offenders and bad statuses (at most 20, clipped), in the site's state file for the operator (never in metrics); the CLI… (18d8822)
docs/operator-alerts.md: the browser check's settle window, retry delay and failure details. (8a981f5)
SSRF regression test for tenant-named hosts (roadmap WS-R task 5). A custom domain is the one host a tenant names, and it is proven by a DNS TXT record through the configured resolver, never by a request to it: test/security-ssrf.test.js… (94e1616)

OpenVibe.Chat

openvibe.chat · repository

N-1: fixtures re-recorded from 6181238 with Live's chat surfaces at 13525eb, the releases in production. The Live-file filter now matches the checkout's own directory name (the harness labels files with it). From a checkout not named… (ac1708a)
Secrets and private rooms, by crawl (roadmap WS-R task 5: internal-secret leak, private room bypass). test/security-crawl.js lists every route of the booted app from Express's router stack (a route added later is crawled without anyone… (655135d)
Detaching a room says nothing to someone who may not (roadmap WS-R task 5: IDOR; low). A member who is not the room's manager got { removed: false } for an attachment that does not exist and 403 for one that does, so they could tell where… (9133c44)
The soundboard's audio download cannot be steered inward (roadmap WS-R task 5: SSRF; low). The audio URL comes from 101soundboards' API answer; its check allowed only 101soundboards.com but judged one DNS answer with its own list, which… (d4704b2)

OpenVibe.Community

openvibe.community · repository

Security crawl for internal secrets (roadmap WS-R task 5: internal-secret leak). test/security-secrets.test.js boots the app with every secret Community reads set to an obviously fake sentinel (sentinel-not-a-secret-<name>)… (cf50b27)
Private things stay private on every read path (roadmap WS-R task 5: private bypass), with four fixes the new test found. test/security-private.test.js seeds private text and screenshot pastes (and a comment on one), an unlisted paste… (249d0ed)
IDOR suite (roadmap WS-R task 5: nobody acts on someone else's things by swapping ids). test/security-idor.test.js: alex owns a public, a private and a screenshot paste, paste comments, a thread with a reply, a typed comment, an uploaded… (7e22a51)
SSRF (roadmap WS-R task 5): Community fetches no URL a user chooses, and a test keeps it so; the live-mode paste proxy no longer lets a visitor's path leave Live's paste API. Every outbound call goes to a base URL from the owner's… (69f5feb)

OpenVibe.Events

events.openvibe.network · repository

Security crawl for secrets (roadmap WS-R task 5: internal-secret leak). Events holds one kind of secret, each subscription's signing secret, and reads none from its environment (test/security-secrets.test.js asserts that: a new… (7efb758)
Private-bypass suite, and an app token is never a realtime service viewer (roadmap WS-R task 5: private bypass; low). test/security-private.test.js publishes public, internal and per-person subject events and app events in two projects and… (2ad3f53)
IDOR suite, and an app's subscriptions are scoped to its project and environment (roadmap WS-R task 5: IDOR; low). test/security-idor.test.js swaps ids between two apps, two projects, two environments and two services: reading, rotating… (04a2857)
SSRF suite for app endpoints and a ratchet over outbound calls (roadmap WS-R task 5: SSRF). test/security-ssrf.test.js tries every internal spelling where an app subscription is made and again where each delivery is made, through the real… (0fcd17a)

OpenVibe.Live

openvibe.live · repository

Security crawl for stream keys and secrets (roadmap WS-R task 5: stream-key exposure, internal-secret leak). test/security-crawl.js boots the real server/index.js as a restore-drill instance (reads only, no outbound connection) on a seeded… (1734f3e)
A streamer's own AI endpoint goes out through the egress guard (roadmap WS-R task 5: SSRF). The AI viewers' "bring your own" base URL is typed by the streamer, but llm.js POSTed to it with a plain fetch: any signed-in user could point POST… (aeb3e68)
IDOR and DM privacy suites (roadmap WS-R task 5: IDOR on objects, private room bypass). test/security-idor.test.js tries every write route that takes an object id with another streamer's id: VODs and clips through Live's Media proxy (edit… (8539e3f)
The soundboard's audio download cannot be steered inward (roadmap WS-R task 5: SSRF; low; the same fix as OpenVibe.Chat's copy). The 101soundboards audio URL comes from that API's answer; its check allowed only 101soundboards.com but… (2e6f546)

OpenVibe.Media

openvibe.media · repository

Internal secrets never leave Media, by test (roadmap WS-R task 5): test/security-secrets.test.js boots the real server/index.js in-process with an obviously fake sentinel for every secret it reads (internal key, signing and view-hash… (db4c60c)
Private and unlisted recordings' thumbnails are no longer listed on the media index (roadmap WS-R task 5; high): the Thumbnails tab of / and /browse listed every file in the thumbnails directory, so a frame of every private or unlisted VOD… (385416d)
A call acting for one user no longer writes another user's media (roadmap WS-R task 5; medium): with the app key and X-OV-User-Id, which is meant to carry that user's permissions, user B could update (visibility included), delete… (62160a8)
The avatar fetch uses openvibe-shared/egress's address rule (roadmap WS-R task 5; low): its own copy had drifted and took the IPv6 forms that wrap an internal IPv4 address (v4-compatible ::127.0.0.1, 6to4 2002:7f00:1::, Teredo), site-local… (1157a54)

OpenVibe.Network

openvibe.network · repository

Security crawl for secrets (roadmap WS-R task 5: internal-secret leak). test/security-secrets.test.js boots the real server with a throwaway RS256 and VAPID pair and a fake low-entropy sentinel in every secret it reads from the… (655e8ad)
Private-bypass and IDOR suites (roadmap WS-R task 5). test/security-private.test.js crawls every GET route Express knows after boot as anonymous, another user, a developer app and a service principal, and no answer may carry alice's… (fd866c0)
Web push endpoints cannot be steered inward (roadmap WS-R task 5: SSRF; low). A push subscription's endpoint is a URL the browser hands over, so anyone signed in chose where Network POSTs: web-push sent to it as stored, 127.0.0.1… (80caea9)
gitleaks allowlist for the SSRF suite's web-push test vector (roadmap WS-R task 5). test/security-ssrf.test.js subscribes with the public example subscription from the web-push documentation; its auth value matches the generic-api-key… (a7e07f7)

OpenVibe.Tools

openvibe.tools · repository

The paste proxy reaches only Community's paste API, and yt-dlp only YouTube links (roadmap WS-R task 5: SSRF; low). The gateway forwarded /api/pastes/* to ${communityUrl}/api/pastes${req.url} with the visitor's token… (3680e83)
Secrets never reach a visitor of the gateway or the maps satellite, by test (roadmap WS-R task 5: internal-secret leak). apps/_shared/test/no-network.js is a preload for a started satellite: every connection or lookup that is not loopback… (427b354)
maps: no RIDB API key in the code. RIDB_API_KEY comes from the environment only (set in production's /etc/openvibe/tools.env on 2026-09-27, before this deploy); without it RIDB is skipped with one warning. The two keys that were defaults… (b635f97)

OpenVibe.Sources

sources.openvibe.network · repository

The fetch guard's address rule cannot drift from the platform's (roadmap WS-R task 5: SSRF; low). Sources keeps its own address list, and it had drifted from openvibe-shared/egress (the rule Live, Events, Chat and Tools use)… (8a7b7ea)
A failed fetch's event no longer carries the endpoint's credential (roadmap WS-R task 5: internal-secret leak; low). sources.fetch.failed named the endpoint as registered, so a feed whose URL carries a provider key (?api_key=…) sent that… (ad53d2f)

Patch notes are put together automatically when enough changes have shipped, or when a large feature lands. See every site's own updates page for the live list.

Patch notes: Private and unlisted recordings' thumbnails are no longer listed on th