Skip to content

Harden WireGuard exports, login throttling, and startup - #1

Merged
barkinarga merged 1 commit into
readmefrom
codex/wireguard-security-hardening-20261110
Nov 9, 2026
Merged

barkinarga merged 1 commit into
readmefrom
codex/wireguard-security-hardening-20261110

Conversation

@barkinarga

Copy link
Copy Markdown
Owner
  • Reject unsafe DNS input and validate saved values before generating client configurations or QR codes.
  • Add opt-in authentication throttling behind a trusted reverse proxy. Scope IPv6 attempts to a /64.
  • Omit expired peers during managed WireGuard startup and accept previously generated configurations that differ only by omitted expired peers.

Validation passed on the exact uploaded tree. This includes Windows Go tests, Ubuntu Go race tests and vet, the UI build and tests, Linux amd64 and arm64 builds, mocked install and update suites, and installer archive verification.

@barkinarga
barkinarga merged commit 3dfaba1 into readme Nov 9, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant