security: v2.0 — AES-GCM crypto, SSRF guards, rate limits, hardening

Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so
existing user secrets, stored messages, and inter-tenant key keep
working. Old clients and relays lose cross-version chat until both
sides are upgraded.

Relay
- Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived
  per-ciphertext salts; keep CBC-V1 fallback on decrypt only.
- On-bootstrap migration re-envelopes tenant secret_encrypted and the
  inter-tenant key to GCM-V2 (idempotent).
- CORS: stop reflecting arbitrary Origin; allow own origin + optional
  RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials.
- Generic error messages replace "no such user: <name>" enumeration.
- Exception messages no longer echoed back; logged server-side.
- Collab-lock max hold capped at 10min so a member can't grief-refresh
  forever.
- Attachment filenames validated against hex.<ext> pattern.
- Passwords min length 10; /api/account/password rate-limited.

App / Electron client
- Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read).
- Chat + collab-buckets plugins delegate to the shared helpers.
- Poll + push + attachments migrated to the dual-format path.
- /api/relay/settings GET returns has_key boolean; secret never echoed.
- Setup endpoint now CSRF-checked.
- SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks
  favicon fetch also blocks private/loopback/link-local.
- Login / password-change rate limiter moved to DB-backed IP keying.
- Passwords min length 10 throughout.
- Zip import enforces per-file (25MB) and total (500MB) caps, extension
  allowlist, no-overwrite.
- Verbose relay-push debug gated behind APP_DEBUG env.

Version bumped to 2.0.0 (protocol-breaking).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

relay/inc/bootstrap.php

@@ -395,6 +395,34 @@ $db->exec('CREATE TABLE IF NOT EXISTS rate_limits (
     attempted_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
 )');
 
+// ── v3.x → v1.10 crypto migration ────────────────────────────────
+// Re-encrypt master-wrapped secrets (tenant client secrets + inter-tenant
+// key) from CBC-V1 to GCM-V2. This only touches data we already hold the
+// master key for, so no user action is needed and no secrets change —
+// only the envelope around them. Idempotent: rows already in V2 skip.
+require_once __DIR__ . '/crypto.php';
+if (tableExists($db, 'tenants')) {
+    $legacyTenantRows = $db->query("SELECT id, secret_encrypted FROM tenants WHERE secret_encrypted IS NOT NULL AND secret_encrypted != '' AND secret_encrypted NOT LIKE '" . HYPRCRD_GCM_MAGIC_MASTER . "%'")->fetchAll();
+    if ($legacyTenantRows) {
+        $upd = $db->prepare('UPDATE tenants SET secret_encrypted = :s WHERE id = :i');
+        foreach ($legacyTenantRows as $r) {
+            $plain = masterDecrypt($r['secret_encrypted'], $MASTER_KEY);
+            if ($plain !== '') {
+                $upd->execute(['s' => masterEncrypt($plain, $MASTER_KEY), 'i' => $r['id']]);
+            }
+        }
+        @error_log('[hyprcrd-relay] migrated ' . count($legacyTenantRows) . ' tenant secret_encrypted rows to GCM-V2');
+    }
+    $legacyItk = $db->query("SELECT value FROM settings WHERE key = 'inter_tenant_key'")->fetchColumn();
+    if ($legacyItk && !str_starts_with($legacyItk, HYPRCRD_GCM_MAGIC_MASTER)) {
+        $plainItk = masterDecrypt($legacyItk, $MASTER_KEY);
+        if ($plainItk !== '') {
+            setInterTenantKey($db, $MASTER_KEY, $plainItk);
+            @error_log('[hyprcrd-relay] migrated inter-tenant key to GCM-V2');
+        }
+    }
+}
+
 // Cleanup: 24h ephemeral storage, expired sessions, old rate limits
 $db->exec("DELETE FROM messages WHERE created_at < datetime('now', '-24 hours')");
 $db->exec("DELETE FROM attachments WHERE created_at < datetime('now', '-24 hours')");

relay/inc/crypto.php

@@ -1,24 +1,54 @@
 <?php
-// Crypto helpers: at-rest encryption with master key, plus the
-// HYPRCRD-RELAY-V1 envelope format used by both the JS client and
-// the relay's internal re-encryption hops.
+// Crypto helpers.
+//
+// Two envelope formats coexist during the v1.10 rollout:
+//
+//   HYPRCRD-GCM-V2   — new: AES-256-GCM, per-ciphertext random salt + HKDF
+//                      (authenticated, standard). Used for every new write.
+//   HYPRCRD-RELAY-V1 — legacy: AES-256-CBC, substr(hex(sha256(secret))) as a
+//                      32-byte ASCII key, no MAC. Dual-read only.
+//
+// For at-rest master-key encryption the legacy format carries no magic
+// prefix (raw base64(iv || cipher)). The new format uses HYPRCRD-MGCM-V2.
+//
+// Same user secret works across both formats — only the KDF and cipher
+// differ. Old data stays readable forever via the V1 fallback; new data
+// is authenticated and cannot be silently mutated.
 
 if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
 
+const HYPRCRD_GCM_MAGIC_CLIENT = 'HYPRCRD-GCM-V2';
+const HYPRCRD_CBC_MAGIC_CLIENT = 'HYPRCRD-RELAY-V1';
+const HYPRCRD_GCM_MAGIC_MASTER = 'HYPRCRD-MGCM-V2';
+const HYPRCRD_HKDF_INFO_CLIENT = 'hyprcrd-relay-client-v2';
+
 /**
- * Encrypt a value at-rest with the master key. Used for tenant secrets
- * and the inter-tenant key in the DB.
+ * Encrypt a value at-rest with the master key. The master key is already
+ * cryptographically random (32 raw bytes), so no KDF stretching is needed —
+ * a fresh 12-byte nonce per ciphertext is enough for GCM.
  */
 function masterEncrypt(string $plain, string $masterKeyHex): string {
     $key = hex2bin($masterKeyHex);
-    $iv = random_bytes(16);
-    $cipher = openssl_encrypt($plain, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
-    return base64_encode($iv . $cipher);
+    $nonce = random_bytes(12);
+    $tag = '';
+    $cipher = openssl_encrypt($plain, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag, '', 16);
+    return HYPRCRD_GCM_MAGIC_MASTER . "\n" . base64_encode($nonce . $cipher . $tag);
 }
 
 function masterDecrypt(string $encoded, string $masterKeyHex): string {
     $key = hex2bin($masterKeyHex);
-    $raw = base64_decode($encoded);
+    if (str_starts_with($encoded, HYPRCRD_GCM_MAGIC_MASTER)) {
+        $b64 = trim(substr($encoded, strlen(HYPRCRD_GCM_MAGIC_MASTER) + 1));
+        $raw = base64_decode($b64, true);
+        if (!$raw || strlen($raw) < 12 + 16 + 1) return '';
+        $nonce = substr($raw, 0, 12);
+        $tag = substr($raw, -16);
+        $cipher = substr($raw, 12, -16);
+        $plain = openssl_decrypt($cipher, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag);
+        return $plain !== false ? $plain : '';
+    }
+    // Legacy: base64(iv(16) || ciphertext) under AES-256-CBC, no prefix.
+    $raw = base64_decode($encoded, true);
     if (!$raw || strlen($raw) < 17) return '';
     $iv = substr($raw, 0, 16);
     $cipher = substr($raw, 16);
@@ -26,27 +56,48 @@ function masterDecrypt(string $encoded, string $masterKeyHex): string {
 }
 
 /**
- * Match the JS client's encryption format exactly:
- *   key = first 32 chars of hex(SHA-256(secret)) used as 32-byte ASCII key
- *   envelope = "HYPRCRD-RELAY-V1\n" + base64(iv || ciphertext)
+ * Encrypt with a user-chosen secret (client API "shared secret" and the
+ * relay-wide inter-tenant key). V2 format:
+ *   magic "\n" base64( salt(16) || nonce(12) || ciphertext || tag(16) )
+ * Per-ciphertext salt feeds HKDF(SHA-256) to derive a fresh 32-byte subkey
+ * — defeats the weak legacy substr-of-hex KDF and removes cross-tenant
+ * key collisions for identical secrets.
  */
 function clientEncrypt(string $plain, string $secret): string {
-    $key = substr(hash('sha256', $secret), 0, 32);
-    $iv = random_bytes(16);
-    $cipher = openssl_encrypt($plain, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
-    return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher);
+    $salt = random_bytes(16);
+    $nonce = random_bytes(12);
+    $key = hash_hkdf('sha256', $secret, 32, HYPRCRD_HKDF_INFO_CLIENT, $salt);
+    $tag = '';
+    $cipher = openssl_encrypt($plain, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag, '', 16);
+    return HYPRCRD_GCM_MAGIC_CLIENT . "\n" . base64_encode($salt . $nonce . $cipher . $tag);
 }
 
 function clientDecrypt(string $envelope, string $secret): string {
-    if (!str_starts_with($envelope, 'HYPRCRD-RELAY-V1')) return $envelope;
-    $b64 = trim(substr($envelope, strlen('HYPRCRD-RELAY-V1') + 1));
-    $raw = base64_decode($b64);
-    if (!$raw || strlen($raw) < 17) return '';
-    $key = substr(hash('sha256', $secret), 0, 32);
-    $iv = substr($raw, 0, 16);
-    $cipher = substr($raw, 16);
-    $result = openssl_decrypt($cipher, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
-    return $result !== false ? $result : '';
+    if (str_starts_with($envelope, HYPRCRD_GCM_MAGIC_CLIENT)) {
+        $b64 = trim(substr($envelope, strlen(HYPRCRD_GCM_MAGIC_CLIENT) + 1));
+        $raw = base64_decode($b64, true);
+        if (!$raw || strlen($raw) < 16 + 12 + 16 + 1) return '';
+        $salt = substr($raw, 0, 16);
+        $nonce = substr($raw, 16, 12);
+        $tag = substr($raw, -16);
+        $cipher = substr($raw, 28, -16);
+        $key = hash_hkdf('sha256', $secret, 32, HYPRCRD_HKDF_INFO_CLIENT, $salt);
+        $plain = openssl_decrypt($cipher, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag);
+        return $plain !== false ? $plain : '';
+    }
+    if (str_starts_with($envelope, HYPRCRD_CBC_MAGIC_CLIENT)) {
+        $b64 = trim(substr($envelope, strlen(HYPRCRD_CBC_MAGIC_CLIENT) + 1));
+        $raw = base64_decode($b64, true);
+        if (!$raw || strlen($raw) < 17) return '';
+        $key = substr(hash('sha256', $secret), 0, 32);
+        $iv = substr($raw, 0, 16);
+        $cipher = substr($raw, 16);
+        $result = openssl_decrypt($cipher, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+        return $result !== false ? $result : '';
+    }
+    // Neither envelope — passthrough. Preserves the old behaviour where
+    // already-plaintext fields flowed through unchanged.
+    return $envelope;
 }
 
 /**
@@ -54,8 +105,7 @@ function clientDecrypt(string $envelope, string $secret): string {
  * during initial setup (it's the third field in the setup form). Used to
  * re-encrypt messages at rest so they can be routed between tenants.
  *
- * Returns null if not set yet (e.g. legacy v2 installs that haven't been
- * upgraded through the new setup wizard).
+ * Returns null if not set yet.
  */
 function getInterTenantKey(PDO $db, string $masterKey): ?string {
     $stored = $db->query("SELECT value FROM settings WHERE key = 'inter_tenant_key'")->fetchColumn();

relay/inc/routes/account.php

@@ -52,11 +52,14 @@ if ($route === '/api/account/secret' && $method === 'DELETE') {
 
 if ($route === '/api/account/password' && $method === 'POST') {
     if (!$sessionTenant) jsonResponse(['error' => 'not logged in'], 401);
+    // Rate-limit password changes — a stolen session cookie could otherwise
+    // brute-force the `current` field server-side with no friction.
+    if (isRateLimited($db, 'account-password', 10)) jsonResponse(['error' => 'too many attempts'], 429);
     $input = json_decode(file_get_contents('php://input'), true) ?: [];
     $current = (string)($input['current'] ?? '');
     $new = (string)($input['new'] ?? '');
 
-    if (strlen($new) < 4) jsonResponse(['error' => 'new password must be at least 4 chars'], 400);
+    if (strlen($new) < 10) jsonResponse(['error' => 'new password must be at least 10 chars'], 400);
     if (!password_verify($current, $sessionTenant['password_hash'])) {
         jsonResponse(['error' => 'current password is wrong'], 401);
     }

relay/inc/routes/admin.php

@@ -28,7 +28,7 @@ if ($route === '/api/users' && $method === 'POST') {
     if (!preg_match('/^[a-zA-Z0-9_-]{2,32}$/', $username)) {
         jsonResponse(['error' => 'username must be 2-32 chars: letters, digits, _ or -'], 400);
     }
-    if (strlen($password) < 4) jsonResponse(['error' => 'password must be at least 4 chars'], 400);
+    if (strlen($password) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400);
     if (getTenantByUsername($db, $username)) jsonResponse(['error' => 'username already exists'], 409);
 
     // No client secret — the new user sets that themselves after first login
@@ -53,7 +53,7 @@ if (preg_match('#^/api/users/(\d+)$#', $route, $m) && $method === 'PATCH') {
     $input = json_decode(file_get_contents('php://input'), true) ?: [];
     $fields = []; $params = ['id' => $id];
     if (!empty($input['password'])) {
-        if (strlen($input['password']) < 4) jsonResponse(['error' => 'password too short'], 400);
+        if (strlen($input['password']) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400);
         $fields[] = 'password_hash = :pw';
         $params['pw'] = password_hash($input['password'], PASSWORD_BCRYPT);
     }

relay/inc/routes/chat.php

@@ -93,7 +93,7 @@ if ($route === '/api/chat/send' && $method === 'POST' && $sessionTenant) {
     if ($body === '') jsonResponse(['error' => 'body required'], 400);
     if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
     $interKey = getInterTenantKey($db, $MASTER_KEY);
     if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
     $stored = clientEncrypt($body, $interKey);
@@ -122,7 +122,7 @@ if ($route === '/api/sync-events' && $method === 'POST') {
     if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
     if ($recipientName === $clientTenant['username']) jsonResponse(['ok' => true, 'id' => 0]); // suppress self-notifications
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
     $db->prepare('INSERT INTO relay_sync_events (recipient_id, sender_username, body) VALUES (:r, :sn, :b)')
         ->execute(['r' => $recipient['id'], 'sn' => $clientTenant['username'], 'b' => $body]);
     jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId()]);
@@ -193,7 +193,8 @@ if ($route === '/api/chat/rooms' && $method === 'POST') {
         $db->commit();
     } catch (Throwable $e) {
         if ($db->inTransaction()) $db->rollBack();
-        jsonResponse(['error' => 'create failed: ' . $e->getMessage()], 500);
+        @error_log('[hyprcrd-relay] chat room create failed: ' . $e->getMessage());
+        jsonResponse(['error' => 'create failed'], 500);
     }
     jsonResponse(['ok' => true, 'uid' => $uid, 'members' => array_values($resolved)]);
 }
@@ -306,7 +307,7 @@ if ($route === '/api/chat' && $method === 'POST') {
             ->execute(['me' => $clientTenant['id'], 's' => $clientTenant['id'], 'sn' => $clientTenant['username'], 'ru' => $roomUid, 'b' => $stored]);
     } else {
         $recipient = getTenantByUsername($db, $recipientName);
-        if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+        if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
         $db->prepare('INSERT INTO chat_messages (recipient_id, sender_id, sender_username, body, persistent) VALUES (:r, :s, :sn, :b, :p)')
             ->execute([
                 'r' => $recipient['id'],
@@ -417,7 +418,7 @@ if ($route === '/api/chat/backfill' && $method === 'GET') {
         $stmt->execute();
     } else {
         $peerTenant = getTenantByUsername($db, $peer);
-        if (!$peerTenant) jsonResponse(['error' => "no such user: $peer"], 404);
+        if (!$peerTenant) jsonResponse(['error' => 'peer not found'], 404);
         $sql = "SELECT id, sender_id, sender_username, room_uid, body, created_at
                 FROM chat_messages
                 WHERE room_uid IS NULL

relay/inc/routes/collab-buckets.php

@@ -50,7 +50,8 @@ if ($route === '/api/collab-buckets' && $method === 'POST') {
         $db->commit();
     } catch (Throwable $e) {
         if ($db->inTransaction()) $db->rollBack();
-        jsonResponse(['error' => 'create failed: ' . $e->getMessage()], 500);
+        @error_log('[hyprcrd-relay] collab bucket create failed: ' . $e->getMessage());
+        jsonResponse(['error' => 'create failed'], 500);
     }
     jsonResponse(['ok' => true, 'uid' => $uid, 'members' => array_values($resolved)]);
 }
@@ -102,7 +103,7 @@ if (preg_match('#^/api/collab-buckets/([a-zA-Z0-9_-]+)$#', $route, $m) && $metho
         $newOwnerName = trim((string)$input['owner']);
         if ($newOwnerName === '') jsonResponse(['error' => 'owner cannot be empty'], 400);
         $newOwner = getTenantByUsername($db, $newOwnerName);
-        if (!$newOwner) jsonResponse(['error' => "no such user: $newOwnerName"], 404);
+        if (!$newOwner) jsonResponse(['error' => 'user not found'], 404);
         $memCheck = $db->prepare('SELECT 1 FROM collab_bucket_members WHERE bucket_uid = :b AND tenant_id = :t');
         $memCheck->execute(['b' => $uid, 't' => $newOwner['id']]);
         if (!$memCheck->fetchColumn()) {

relay/inc/routes/collab-cards.php

@@ -243,6 +243,14 @@ if (preg_match('#^/api/collab-cards/([a-zA-Z0-9_-]+)/([a-zA-Z0-9_-]+)$#', $route
 
 // ── Collab attachments (images/PDFs/audio referenced by collab cards) ─
 
+// Attachment filenames always follow the hyprcrd upload pattern
+// (bin2hex(random_bytes(16)).<ext>). Enforce server-side so malicious
+// clients can't poison the DB with traversal-shaped names that later
+// surface in UIs or get forwarded to filesystem APIs.
+function collabAttachmentFilenameValid(string $fn): bool {
+    return (bool)preg_match('/^[a-f0-9]{8,64}\.[a-z0-9]{1,8}$/', $fn);
+}
+
 if ($route === '/api/collab-attachments' && $method === 'POST') {
     if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
     $input = json_decode(file_get_contents('php://input'), true) ?: [];
@@ -250,6 +258,7 @@ if ($route === '/api/collab-attachments' && $method === 'POST') {
     $filename = (string)($input['filename'] ?? '');
     $data = (string)($input['data'] ?? '');
     if (!$bucketUid || !$filename || !$data) jsonResponse(['error' => 'bucket_uid, filename, and data required'], 400);
+    if (!collabAttachmentFilenameValid($filename)) jsonResponse(['error' => 'invalid filename'], 400);
     if (!collabCardsIsMember($db, $bucketUid, (int)$clientTenant['id'])) {
         jsonResponse(['error' => 'not a member of this bucket'], 403);
     }
@@ -277,6 +286,7 @@ if ($route === '/api/collab-attachments' && $method === 'GET') {
     $bucketUid = trim($_GET['bucket_uid'] ?? '');
     $filename = trim($_GET['filename'] ?? '');
     if (!$bucketUid) jsonResponse(['error' => 'bucket_uid required'], 400);
+    if ($filename !== '' && !collabAttachmentFilenameValid($filename)) jsonResponse(['error' => 'invalid filename'], 400);
     if (!collabCardsIsMember($db, $bucketUid, (int)$clientTenant['id'])) {
         jsonResponse(['error' => 'not a member of this bucket'], 403);
     }

relay/inc/routes/collab-locks.php

@@ -20,6 +20,13 @@ function collabLocksIsMember(PDO $db, string $bucketUid, int $tenantId): bool {
 
 // ── POST: acquire/refresh ────────────────────────────────────────
 
+// Maximum time a single holder can keep refreshing the same lock. Without a
+// cap a malicious member could heartbeat forever, blocking every other
+// member's writes. 10 minutes is long enough for any real edit session and
+// short enough to time-box grief. When the cap is hit the lock is force-
+// released and the client must re-acquire — giving everyone else a window.
+const COLLAB_LOCK_MAX_HOLD_SECONDS = 600;
+
 if ($route === '/api/collab-locks' && $method === 'POST') {
     if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
     if (isRateLimited($db, 'collab-locks-post', 240)) jsonResponse(['error' => 'rate limited'], 429);
@@ -35,8 +42,12 @@ if ($route === '/api/collab-locks' && $method === 'POST') {
     // narrow window between cleanup and this query.
     $db->prepare("DELETE FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c AND expires_at <= datetime('now')")
         ->execute(['b' => $bucketUid, 'c' => $cardUid]);
+    // Also drop locks that have been refreshed past the max hold window —
+    // cap enforcement for grief prevention.
+    $db->prepare("DELETE FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c AND acquired_at <= datetime('now', '-" . COLLAB_LOCK_MAX_HOLD_SECONDS . " seconds')")
+        ->execute(['b' => $bucketUid, 'c' => $cardUid]);
     // Existing live lock? If a different tenant holds it, refuse.
-    $cur = $db->prepare('SELECT holder_id, holder_username, expires_at FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c');
+    $cur = $db->prepare('SELECT holder_id, holder_username, expires_at, acquired_at FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c');
     $cur->execute(['b' => $bucketUid, 'c' => $cardUid]);
     $existing = $cur->fetch();
     if ($existing && (int)$existing['holder_id'] !== (int)$clientTenant['id']) {

relay/inc/routes/messages.php

@@ -21,7 +21,7 @@ if ($route === '/api/messages' && $method === 'POST' && $sessionTenant && empty(
     if ($body === '') jsonResponse(['error' => 'body required'], 400);
 
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
 
     $interKey = getInterTenantKey($db, $MASTER_KEY);
     if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
@@ -54,7 +54,7 @@ if ($route === '/api/attachments/upload' && $method === 'POST' && $sessionTenant
     if (!$relayUid) jsonResponse(['error' => 'relay_uid required'], 400);
 
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
 
     $interKey = getInterTenantKey($db, $MASTER_KEY);
     if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
@@ -142,7 +142,7 @@ if ($route === '/api/messages' && $method === 'POST') {
     if ($encryptedBody === '') jsonResponse(['error' => 'body required'], 400);
 
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
 
     // Decrypt with sender's secret
     if (empty($clientTenant['secret_encrypted'])) {
@@ -225,9 +225,12 @@ if ($route === '/api/attachments' && $method === 'POST') {
     $data = (string)($input['data'] ?? '');
     $recipientName = trim((string)($input['recipient'] ?? $clientTenant['username']));
     if (!$relayUid || !$filename || !$data) jsonResponse(['error' => 'relay_uid, filename, and data required'], 400);
+    // Enforce the hyprcrd upload naming scheme server-side so traversal-shaped
+    // names never enter storage or get forwarded back to other clients.
+    if (!preg_match('/^[a-f0-9]{8,64}\.[a-z0-9]{1,8}$/', $filename)) jsonResponse(['error' => 'invalid filename'], 400);
 
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
 
     // Decrypt-reencrypt hop, same shape as messages: arrives encrypted with
     // sender's secret, gets stored at-rest under the inter-tenant key.

relay/inc/routes/public.php

@@ -49,7 +49,7 @@ if ($route === '/api/setup' && $method === 'POST') {
     if (!preg_match('/^[a-zA-Z0-9_-]{2,32}$/', $username)) {
         jsonResponse(['error' => 'username must be 2-32 chars: letters, digits, _ or -'], 400);
     }
-    if (strlen($password) < 4) jsonResponse(['error' => 'password must be at least 4 chars'], 400);
+    if (strlen($password) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400);
     if (strlen($superSecret) < 12) jsonResponse(['error' => 'super-shared secret must be at least 12 chars'], 400);
 
     // Create the admin tenant. NO client secret yet — the admin (and every

relay/index.php

@@ -40,10 +40,25 @@ $isSetup = tenantCount($db) === 0;
 
 if (str_starts_with($route, '/api/')) {
     header('Content-Type: application/json');
+    // CORS: the hyprcrd client hits us server-side (no browser CORS in play)
+    // and the relay UI lives same-origin, so the only legitimate cross-origin
+    // callers are other tenant UIs on the same relay host. We allow the
+    // relay's own scheme+host, plus an opt-in allowlist via RELAY_CORS_ORIGINS
+    // (comma-separated). Credentials are intentionally NOT allowed — API auth
+    // is header-based (X-Relay-User/Key) and the UI is same-origin.
     $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
-    if ($origin) {
+    $ownScheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https' ? 'https' : 'http';
+    $ownOrigin = $ownScheme . '://' . ($_SERVER['HTTP_HOST'] ?? '');
+    $allowed = [$ownOrigin];
+    $extra = getenv('RELAY_CORS_ORIGINS');
+    if ($extra) {
+        foreach (explode(',', $extra) as $o) {
+            $o = trim($o);
+            if ($o !== '') $allowed[] = $o;
+        }
+    }
+    if ($origin && in_array($origin, $allowed, true)) {
         header('Access-Control-Allow-Origin: ' . $origin);
-        header('Access-Control-Allow-Credentials: true');
         header('Vary: Origin');
     }
     header('Access-Control-Allow-Headers: Content-Type, X-Relay-User, X-Relay-Key');

relay/ui/app.js

@@ -199,7 +199,7 @@ async function doChangePassword() {
     const err = $('cp-err');
     err.textContent = '';
     if (!current || !newPw) { err.textContent = 'all fields required'; return; }
-    if (newPw.length < 4) { err.textContent = 'new password too short'; return; }
+    if (newPw.length < 10) { err.textContent = 'new password must be at least 10 chars'; return; }
     if (newPw !== newPw2) { err.textContent = 'new passwords don\'t match'; return; }
     if (current === newPw) { err.textContent = 'new password must differ from current'; return; }
 
@@ -231,7 +231,7 @@ async function doSetup() {
     const err = $('setup-err');
     err.textContent = '';
     if (!username) { err.textContent = 'username required'; return; }
-    if (password.length < 4) { err.textContent = 'password too short'; return; }
+    if (password.length < 10) { err.textContent = 'password must be at least 10 chars'; return; }
     if (superSecret.length < 12) { err.textContent = 'super-shared secret needs at least 12 chars'; return; }
     const res = await api('api/setup', { method: 'POST', body: { username, password, super_secret: superSecret } });
     if (res.ok) {
@@ -1039,8 +1039,8 @@ async function createUser() {
 }
 
 async function resetUserPassword(id, username) {
-    const newPw = prompt(`new password for ${username} (min 4 chars):`);
-    if (!newPw || newPw.length < 4) { toast('password too short', true); return; }
+    const newPw = prompt(`new password for ${username} (min 10 chars):`);
+    if (!newPw || newPw.length < 10) { toast('password too short', true); return; }
     const res = await api('api/users/' + id, { method: 'PATCH', body: { password: newPw } });
     if (res.ok) toast('password updated');
     else toast(res.error || 'failed', true);

relay/ui/layout.php

@@ -47,7 +47,7 @@ if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
     </div>
     <div class="field">
         <label>admin password</label>
-        <input type="password" id="setup-password" placeholder="min 4 chars" autocomplete="new-password">
+        <input type="password" id="setup-password" placeholder="min 10 chars" autocomplete="new-password">
     </div>
     <div class="field">
         <label>super-shared secret</label>
@@ -144,7 +144,7 @@ if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
     </div>
     <div class="field">
         <label>new password</label>
-        <input type="password" id="cp-new" placeholder="min 4 chars" autocomplete="new-password">
+        <input type="password" id="cp-new" placeholder="min 10 chars" autocomplete="new-password">
     </div>
     <div class="field">
         <label>confirm new password</label>
@@ -205,7 +205,7 @@ if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
             </div>
             <div class="field">
                 <label for="new-password">password</label>
-                <input type="password" id="new-password" placeholder="min 4 chars" autocomplete="new-password">
+                <input type="password" id="new-password" placeholder="min 10 chars" autocomplete="new-password">
             </div>
             <label class="checkbox">
                 <input type="checkbox" id="new-is-admin"> grant admin privileges