security: v2.0 — AES-GCM crypto, SSRF guards, rate limits, hardening

Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so
existing user secrets, stored messages, and inter-tenant key keep
working. Old clients and relays lose cross-version chat until both
sides are upgraded.

Relay
- Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived
  per-ciphertext salts; keep CBC-V1 fallback on decrypt only.
- On-bootstrap migration re-envelopes tenant secret_encrypted and the
  inter-tenant key to GCM-V2 (idempotent).
- CORS: stop reflecting arbitrary Origin; allow own origin + optional
  RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials.
- Generic error messages replace "no such user: <name>" enumeration.
- Exception messages no longer echoed back; logged server-side.
- Collab-lock max hold capped at 10min so a member can't grief-refresh
  forever.
- Attachment filenames validated against hex.<ext> pattern.
- Passwords min length 10; /api/account/password rate-limited.

App / Electron client
- Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read).
- Chat + collab-buckets plugins delegate to the shared helpers.
- Poll + push + attachments migrated to the dual-format path.
- /api/relay/settings GET returns has_key boolean; secret never echoed.
- Setup endpoint now CSRF-checked.
- SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks
  favicon fetch also blocks private/loopback/link-local.
- Login / password-change rate limiter moved to DB-backed IP keying.
- Passwords min length 10 throughout.
- Zip import enforces per-file (25MB) and total (500MB) caps, extension
  allowlist, no-overwrite.
- Verbose relay-push debug gated behind APP_DEBUG env.

Version bumped to 2.0.0 (protocol-breaking).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -15,3 +15,4 @@ data/hyprcrd.db-wal
 /oumta-dashboard/
 /oumta-dashboard-ui/
 
+relay/data

config.php

@@ -1,7 +1,11 @@
 <?php
 
 define('APP_NAME', 'hyprcrd');
-define('APP_VERSION', '1.9.29');
+define('APP_VERSION', '2.0.0');
+
+// APP_DEBUG: gates verbose error responses (curl traces, upstream bodies).
+// Off by default; enable via env for local troubleshooting only.
+define('APP_DEBUG', getenv('APP_DEBUG') === '1' || getenv('APP_DEBUG') === 'true');
 
 // Database path — writable directory, outside webroot
 // DB_PATH / UPLOAD_DIR can be pre-defined by the Electron router for app isolation

electron/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hyprcrd",
-  "version": "1.9.29",
+  "version": "2.0.0",
   "description": "hyprcrd — self-hosted card manager",
   "main": "main.js",
   "scripts": {

public/index.php

@@ -55,6 +55,22 @@ if (str_starts_with($route, '/api/auth')) {
     error_reporting(0);
     header('Content-Type: application/json');
 
+    // IP-keyed rate limiter for auth endpoints — session cookies are trivial
+    // to rotate, so the in-session counter alone is bypassable.
+    $hyprcrdClientIp = $_SERVER['REMOTE_ADDR'] ?? '';
+    $db->exec("DELETE FROM login_attempts WHERE attempted_at < datetime('now', '-10 minutes')");
+    $hyprcrdIpRateLimited = function (string $endpoint, int $max, int $windowMinutes = 5) use ($db, $hyprcrdClientIp): bool {
+        if ($hyprcrdClientIp === '') return false;
+        $q = $db->prepare("SELECT COUNT(*) FROM login_attempts WHERE ip = :ip AND endpoint = :ep AND attempted_at > datetime('now', '-{$windowMinutes} minutes')");
+        $q->execute(['ip' => $hyprcrdClientIp, 'ep' => $endpoint]);
+        return (int)$q->fetchColumn() >= $max;
+    };
+    $hyprcrdRecordAttempt = function (string $endpoint) use ($db, $hyprcrdClientIp): void {
+        if ($hyprcrdClientIp === '') return;
+        $db->prepare('INSERT INTO login_attempts (ip, endpoint) VALUES (:ip, :ep)')
+            ->execute(['ip' => $hyprcrdClientIp, 'ep' => $endpoint]);
+    };
+
     // GET /api/auth/status
     if ($route === '/api/auth/status' && $method === 'GET') {
         echo json_encode(['setup' => $isSetup, 'logged_in' => $isLoggedIn, 'csrf' => $_SESSION['csrf_token'], 'version' => APP_VERSION]);
@@ -63,11 +79,20 @@ if (str_starts_with($route, '/api/auth')) {
 
     // POST /api/auth/setup — set initial password
     if ($route === '/api/auth/setup' && $method === 'POST' && $isSetup) {
+        // CSRF: same-origin + same-session guarantee. A drive-by POST from
+        // another site won't have the csrf cookie-bound token, so it can't
+        // silently claim a freshly-provisioned instance.
+        $csrfHeader = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
+        if (!hash_equals($_SESSION['csrf_token'] ?? '', $csrfHeader)) {
+            http_response_code(403);
+            echo json_encode(['error' => 'invalid csrf token']);
+            exit;
+        }
         $input = json_decode(file_get_contents('php://input'), true);
         $pw = $input['password'] ?? '';
-        if (strlen($pw) < 4) {
+        if (strlen($pw) < 10) {
             http_response_code(400);
-            echo json_encode(['error' => 'password too short (min 4)']);
+            echo json_encode(['error' => 'password too short (min 10)']);
             exit;
         }
         $hash = password_hash($pw, PASSWORD_BCRYPT);
@@ -79,13 +104,11 @@ if (str_starts_with($route, '/api/auth')) {
         exit;
     }
 
-    // POST /api/auth/login (rate limited)
+    // POST /api/auth/login (IP-keyed rate limit)
     if ($route === '/api/auth/login' && $method === 'POST') {
-        $attempts = $_SESSION['login_attempts'] ?? 0;
+        if ($hyprcrdIpRateLimited('login', 10, 5)) {
-        $lastAttempt = $_SESSION['login_last'] ?? 0;
-        if ($attempts >= 5 && time() - $lastAttempt < 60) {
             http_response_code(429);
-            echo json_encode(['error' => 'too many attempts, wait 60s']);
+            echo json_encode(['error' => 'too many attempts, try again later']);
             exit;
         }
         $input = json_decode(file_get_contents('php://input'), true);
@@ -94,11 +117,9 @@ if (str_starts_with($route, '/api/auth')) {
             session_regenerate_id(true);
             $_SESSION['hyprcrd_auth'] = true;
             $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
-            $_SESSION['login_attempts'] = 0;
             echo json_encode(['ok' => true, 'csrf' => $_SESSION['csrf_token']]);
         } else {
-            $_SESSION['login_attempts'] = $attempts + 1;
+            $hyprcrdRecordAttempt('login');
-            $_SESSION['login_last'] = time();
             usleep(300000); // 300ms delay against timing attacks
             http_response_code(401);
             echo json_encode(['error' => 'wrong password']);
@@ -159,18 +180,24 @@ if (str_starts_with($route, '/api/auth')) {
 
     // POST /api/auth/password — change password (requires current password)
     if ($route === '/api/auth/password' && $method === 'POST') {
+        if ($hyprcrdIpRateLimited('password', 10, 5)) {
+            http_response_code(429);
+            echo json_encode(['error' => 'too many attempts, try again later']);
+            exit;
+        }
         $input = json_decode(file_get_contents('php://input'), true);
         $current = $input['current'] ?? '';
         $newPass = $input['new'] ?? '';
         $hash = $db->query("SELECT value FROM settings WHERE key = 'password_hash'")->fetchColumn();
         if (!password_verify($current, $hash)) {
+            $hyprcrdRecordAttempt('password');
             http_response_code(403);
             echo json_encode(['error' => 'wrong password']);
             exit;
         }
-        if (strlen($newPass) < 4) {
+        if (strlen($newPass) < 10) {
             http_response_code(400);
-            echo json_encode(['error' => 'min 4 characters']);
+            echo json_encode(['error' => 'min 10 characters']);
             exit;
         }
         $newHash = password_hash($newPass, PASSWORD_BCRYPT);
@@ -752,21 +779,37 @@ if (str_starts_with($route, '/api/')) {
             }
         }
 
-        // Extract uploads
+        // Extract uploads. Guard against zip bombs and malicious payloads:
+        // per-file 25MB cap, 500MB total, whitelist allowed extensions (same
+        // set as the live /api/upload endpoint), never overwrite existing
+        // files, never leak paths via traversal.
         $uploadDir = UPLOAD_DIR;
         if (!is_dir($uploadDir)) mkdir($uploadDir, 0777, true);
+        $allowedExts = ['png', 'jpg', 'jpeg', 'gif', 'webp', 'mp3', 'ogg', 'wav', 'm4a', 'pdf'];
+        $perFileMax = 25 * 1024 * 1024;   // 25 MB
+        $totalMax   = 500 * 1024 * 1024;  // 500 MB
+        $totalWritten = 0;
+        $skipped = [];
         for ($i = 0; $i < $zip->numFiles; $i++) {
             $name = $zip->getNameIndex($i);
-            if (str_starts_with($name, 'uploads/') && $name !== 'uploads/') {
+            if (!str_starts_with($name, 'uploads/') || $name === 'uploads/') continue;
+            $base = basename($name);
+            $ext = strtolower(pathinfo($base, PATHINFO_EXTENSION));
+            if (!in_array($ext, $allowedExts, true)) { $skipped[] = $base; continue; }
+            $stat = $zip->statIndex($i);
+            if ($stat && isset($stat['size']) && $stat['size'] > $perFileMax) { $skipped[] = $base; continue; }
+            if ($totalWritten + (int)($stat['size'] ?? 0) > $totalMax) { $skipped[] = $base; continue; }
+            $dest = $uploadDir . '/' . $base;
+            if (file_exists($dest)) { $skipped[] = $base; continue; }
             $content = $zip->getFromIndex($i);
-                if ($content !== false) {
+            if ($content === false) continue;
-                    file_put_contents($uploadDir . '/' . basename($name), $content);
+            if (strlen($content) > $perFileMax) { $skipped[] = $base; continue; }
-                }
+            file_put_contents($dest, $content);
-            }
+            $totalWritten += strlen($content);
         }
         $zip->close();
 
-        echo json_encode(['ok' => true, 'buckets' => count($data['buckets']), 'cards' => count($data['cards'])]);
+        echo json_encode(['ok' => true, 'buckets' => count($data['buckets']), 'cards' => count($data['cards']), 'skipped_files' => count($skipped)]);
         exit;
     }
 
@@ -793,18 +836,27 @@ if (str_starts_with($route, '/api/')) {
         $url = $db->query("SELECT value FROM settings WHERE key = 'relay_url'")->fetchColumn() ?: '';
         $username = $db->query("SELECT value FROM settings WHERE key = 'relay_username'")->fetchColumn() ?: '';
         $key = $db->query("SELECT value FROM settings WHERE key = 'relay_key'")->fetchColumn() ?: '';
-        // Single-user local app — echo the stored secret back so the user can
+        // Never echo the plaintext secret to the client — if it leaks via XSS
-        // see and edit it directly without guessing if it's still saved.
+        // or a compromised session, the attacker can decrypt all relay traffic.
-        echo json_encode(['url' => $url, 'username' => $username, 'key' => $key]); exit;
+        // The UI just needs to know whether a secret is set.
+        echo json_encode(['url' => $url, 'username' => $username, 'has_key' => !empty($key)]); exit;
     }
 
     if ($route === '/api/relay/settings' && $method === 'POST') {
         $input = json_decode(file_get_contents('php://input'), true);
         if (isset($input['url'])) $db->prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('relay_url', :v)")->execute(['v' => $input['url']]);
         if (isset($input['username'])) $db->prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('relay_username', :v)")->execute(['v' => $input['username']]);
-        // Always overwrite key when present (even empty) — single-user local
+        // The UI no longer receives the stored secret, so empty strings are
-        // app, the input is now pre-populated so an empty submit is intentional
+        // just "field untouched" and we only write when the user types a new
-        if (array_key_exists('key', $input)) $db->prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('relay_key', :v)")->execute(['v' => $input['key']]);
+        // value. An explicit null clears the secret for users who need it.
+        if (array_key_exists('key', $input)) {
+            $newKey = $input['key'];
+            if ($newKey === null) {
+                $db->prepare("DELETE FROM settings WHERE key = 'relay_key'")->execute();
+            } elseif (is_string($newKey) && $newKey !== '') {
+                $db->prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('relay_key', :v)")->execute(['v' => $newKey]);
+            }
+        }
         echo json_encode(['ok' => true]); exit;
     }
 
@@ -831,6 +883,7 @@ if (str_starts_with($route, '/api/')) {
             CURLOPT_HTTPHEADER => ['X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey],
             CURLOPT_TIMEOUT => 10,
         ]);
+        hyprcrdApplySafeCurlOpts($ch);
         $response = curl_exec($ch);
         $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
         curl_close($ch);
@@ -851,13 +904,15 @@ if (str_starts_with($route, '/api/')) {
         if (!is_array($messages)) { echo json_encode(['ok' => false, 'error' => 'invalid response']); exit; }
 
         $pulled = 0;
-        $encKey = substr(hash('sha256', $relayKey), 0, 32);
+        $decryptField = function($text) use ($relayKey) {
-        $decryptField = function($text) use ($encKey) {
+            $decoded = hyprcrdRelayDecrypt($text, $relayKey);
-            if (!str_starts_with($text, 'HYPRCRD-RELAY-V1')) return $text;
+            // Dual-format decrypt returns '' only when a magic-prefixed
-            $raw = base64_decode(trim(explode("\n", $text, 2)[1] ?? ''));
+            // envelope failed to decrypt — surface the original string in
-            if (strlen($raw) < 17) return $text;
+            // that case so the UI still shows something useful.
-            $plain = openssl_decrypt(substr($raw, 16), 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, substr($raw, 0, 16));
+            if ($decoded === '' && (str_starts_with($text, HYPRCRD_RELAY_GCM_MAGIC) || str_starts_with($text, HYPRCRD_RELAY_CBC_MAGIC))) {
-            return $plain !== false ? $plain : $text;
+                return $text;
+            }
+            return $decoded;
         };
 
         // Load IDs we pushed ourselves
@@ -920,6 +975,7 @@ if (str_starts_with($route, '/api/')) {
                     ],
                     CURLOPT_TIMEOUT => 5,
                 ]);
+                hyprcrdApplySafeCurlOpts($bch);
                 $bRes = curl_exec($bch);
                 $bStat = curl_getinfo($bch, CURLINFO_HTTP_CODE);
                 curl_close($bch);
@@ -936,6 +992,7 @@ if (str_starts_with($route, '/api/')) {
                     CURLOPT_HTTPHEADER => ['X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey],
                     CURLOPT_TIMEOUT => 30,
                 ]);
+                hyprcrdApplySafeCurlOpts($ach);
                 $attResponse = curl_exec($ach);
                 $attStatus = curl_getinfo($ach, CURLINFO_HTTP_CODE);
                 curl_close($ach);
@@ -949,17 +1006,23 @@ if (str_starts_with($route, '/api/')) {
                         if (!preg_match('/^[a-f0-9]+\.\w+$/', $fn)) continue;
                         $dest = $uploadDir . '/' . $fn;
                         if (file_exists($dest)) continue;
-                        // New format: HYPRCRD-RELAY-V1 envelope (decrypt-reencrypted by relay)
+                        // Dual-format: GCM-V2 envelope (v1.10+) and legacy
-                        // Old format: raw base64(iv || cipher)
+                        // CBC-V1 envelope; plaintext inside is base64(file
+                        // bytes). Very-old pre-envelope format was raw
+                        // base64(iv || cipher) — unlikely at this point but
+                        // cheap to keep as a last-resort fallback.
                         $payload = $att['data'] ?? '';
-                        if (str_starts_with($payload, 'HYPRCRD-RELAY-V1')) {
+                        $decrypted = false;
-                            $b64 = trim(substr($payload, strlen('HYPRCRD-RELAY-V1') + 1));
+                        if (str_starts_with($payload, HYPRCRD_RELAY_GCM_MAGIC) || str_starts_with($payload, HYPRCRD_RELAY_CBC_MAGIC)) {
-                            $raw = base64_decode($b64);
+                            $plain = hyprcrdRelayDecrypt($payload, $relayKey);
+                            if ($plain !== '') $decrypted = $plain;
                         } else {
+                            $legacyKey = substr(hash('sha256', $relayKey), 0, 32);
                             $raw = base64_decode($payload);
+                            if ($raw !== false && strlen($raw) >= 17) {
+                                $decrypted = openssl_decrypt(substr($raw, 16), 'aes-256-cbc', $legacyKey, OPENSSL_RAW_DATA, substr($raw, 0, 16));
+                            }
                         }
-                        if (strlen($raw) >= 17) {
-                            $decrypted = openssl_decrypt(substr($raw, 16), 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, substr($raw, 0, 16));
                         if ($decrypted !== false) {
                             $fileBytes = base64_decode($decrypted);
                             if ($fileBytes !== false) $decrypted = $fileBytes;
@@ -969,7 +1032,6 @@ if (str_starts_with($route, '/api/')) {
                 }
             }
         }
-        }
 
         // Drain pending sync-event notifications so the JS caller can toast
         // them. GET /api/sync-events on the relay auto-marks fetched events.
@@ -982,6 +1044,7 @@ if (str_starts_with($route, '/api/')) {
             CURLOPT_HTTPHEADER => ['X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey],
             CURLOPT_TIMEOUT => 5,
         ]);
+        hyprcrdApplySafeCurlOpts($sch);
         $sResp = curl_exec($sch);
         $sStatus = curl_getinfo($sch, CURLINFO_HTTP_CODE);
         curl_close($sch);
@@ -1015,6 +1078,7 @@ if (str_starts_with($route, '/api/')) {
             CURLOPT_HTTPHEADER => ['X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey],
             CURLOPT_TIMEOUT => 10,
         ]);
+        hyprcrdApplySafeCurlOpts($ch);
         $response = curl_exec($ch);
         $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
         curl_close($ch);
@@ -1054,12 +1118,7 @@ if (str_starts_with($route, '/api/')) {
             $db->prepare('UPDATE cards SET relay_uid = ? WHERE id = ?')->execute([$relayUid, $cardId]);
         }
 
-        $encKey = substr(hash('sha256', $relayKey), 0, 32);
+        $encryptField = fn($text) => hyprcrdRelayEncrypt((string)$text, $relayKey);
-        $encryptField = function($text) use ($encKey) {
-            $iv = random_bytes(16);
-            $cipher = openssl_encrypt($text, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
-            return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher);
-        };
 
         $payloadData = [
             'title'     => $encryptField($card['title'] ?? ''),
@@ -1072,21 +1131,27 @@ if (str_starts_with($route, '/api/')) {
         $payload = json_encode($payloadData);
 
         $ch = curl_init(rtrim($relayUrl, '/') . '/api/messages');
-        $debugStream = fopen('php://temp', 'w+');
+        $debugStream = APP_DEBUG ? fopen('php://temp', 'w+') : null;
         curl_setopt_array($ch, [
             CURLOPT_RETURNTRANSFER => true,
             CURLOPT_POST => true,
             CURLOPT_POSTFIELDS => $payload,
             CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey],
             CURLOPT_TIMEOUT => 10,
-            CURLOPT_VERBOSE => true,
-            CURLOPT_STDERR => $debugStream,
         ]);
+        hyprcrdApplySafeCurlOpts($ch);
+        if ($debugStream) {
+            curl_setopt($ch, CURLOPT_VERBOSE, true);
+            curl_setopt($ch, CURLOPT_STDERR, $debugStream);
+        }
         $response = curl_exec($ch);
         $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+        $curlDebug = '';
+        if ($debugStream) {
             rewind($debugStream);
             $curlDebug = stream_get_contents($debugStream);
             fclose($debugStream);
+        }
         curl_close($ch);
 
         if ($status === 200 || $status === 201) {
@@ -1121,6 +1186,7 @@ if (str_starts_with($route, '/api/')) {
                     CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey],
                     CURLOPT_TIMEOUT => 30,
                 ]);
+                hyprcrdApplySafeCurlOpts($ach);
                 curl_exec($ach);
                 curl_close($ach);
             }
@@ -1135,16 +1201,15 @@ if (str_starts_with($route, '/api/')) {
         } elseif (is_string($response) && $response !== '') {
             $relayMsg = ' — ' . substr($response, 0, 200);
         }
-        // Strip the X-Relay-Key value from the debug log so we don't leak the secret
+        // In production, don't leak upstream URL / raw bodies / curl traces —
-        $safeDebug = preg_replace('/(X-Relay-Key:\s*)[^\r\n]+/i', '$1<redacted>', $curlDebug);
+        // APP_DEBUG=1 re-enables them for local troubleshooting.
-        echo json_encode([
+        $out = ['ok' => false, 'error' => "relay returned HTTP $status$relayMsg", 'sent_username' => $relayUser];
-            'ok' => false,
+        if (APP_DEBUG) {
-            'error' => "relay returned HTTP $status$relayMsg",
+            $out['relay_url'] = rtrim($relayUrl, '/') . '/api/messages';
-            'sent_username' => $relayUser,
+            $out['response_body'] = is_string($response) ? substr($response, 0, 500) : null;
-            'relay_url' => rtrim($relayUrl, '/') . '/api/messages',
+            $out['curl_debug'] = preg_replace('/(X-Relay-Key:\s*)[^\r\n]+/i', '$1<redacted>', $curlDebug);
-            'response_body' => is_string($response) ? substr($response, 0, 500) : null,
+        }
-            'curl_debug' => $safeDebug,
+        echo json_encode($out);
-        ]);
         exit;
     }
 

public/js/app.js

@@ -194,11 +194,11 @@ async function checkAuth() {
 
     if (data.setup) {
         let pw = null;
-        while (!pw || pw.length < 4) {
+        while (!pw || pw.length < 10) {
-            pw = await showDialog({ title: 'setup', message: 'Welcome to hyprcrd. Set a password:', input: 'password', placeholder: '> password (min. 4 chars)...', okLabel: 'Set', cancelLabel: '' });
+            pw = await showDialog({ title: 'setup', message: 'Welcome to hyprcrd. Set a password:', input: 'password', placeholder: '> password (min. 10 chars)...', okLabel: 'Set', cancelLabel: '' });
-            if (pw && pw.length < 4) pw = null;
+            if (pw && pw.length < 10) pw = null;
         }
-        const r = await fetch('api/auth/setup', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ password: pw }) });
+        const r = await fetch('api/auth/setup', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': data.csrf || '' }, body: JSON.stringify({ password: pw }) });
         const d = await r.json();
         if (d.error) { location.reload(); return; }
         if (d.csrf) { setCsrf(d.csrf); window.hyprcrd?.util?.setCsrf?.(d.csrf); }

public/js/modules/sync.js

@@ -321,8 +321,11 @@ export async function loadRelaySettings() {
     if (urlInput) urlInput.value = s.url || '';
     if (userInput) userInput.value = s.username || '';
     if (keyInput) {
-        keyInput.value = s.key || '';
+        // The server no longer echoes the stored secret. Leave the field
-        keyInput.placeholder = 'shared secret';
+        // blank; placeholder tells the user whether one is set. An empty
+        // save is treated as "field untouched" server-side.
+        keyInput.value = '';
+        keyInput.placeholder = s.has_key ? '•••••••• (saved — type to change)' : 'shared secret';
     }
     // Sync-interval slider lives in the Relay panel but drives every
     // poller. Snap points span 5s..1h; live label updates on drag,

public/js/modules/theme.js

@@ -411,7 +411,7 @@ $('settings-pw-save')?.addEventListener('click', async () => {
 
     if (!current || !newPw) { if (status) { status.textContent = 'fill all fields'; status.style.color = 'var(--t-danger)'; } return; }
     if (newPw !== confirm) { if (status) { status.textContent = 'passwords do not match'; status.style.color = 'var(--t-danger)'; } return; }
-    if (newPw.length < 4) { if (status) { status.textContent = 'min 4 characters'; status.style.color = 'var(--t-danger)'; } return; }
+    if (newPw.length < 10) { if (status) { status.textContent = 'min 10 characters'; status.style.color = 'var(--t-danger)'; } return; }
 
     const res = await fetch('api/auth/password', {
         method: 'POST',

public/plugins/bookmarks/backend.php

@@ -20,6 +20,17 @@ PluginManager::instance()->onApiRoute(function (string $route, string $method) {
         echo json_encode(['error' => 'valid url required']);
         exit;
     }
+    $scheme = strtolower((string)parse_url($url, PHP_URL_SCHEME));
+    if ($scheme !== 'http' && $scheme !== 'https') {
+        http_response_code(400);
+        echo json_encode(['error' => 'only http/https URLs allowed']);
+        exit;
+    }
+    if (!hyprcrdUrlHostIsPublic($url)) {
+        http_response_code(400);
+        echo json_encode(['error' => 'URL host is not publicly reachable']);
+        exit;
+    }
 
     $ch = curl_init($url);
     curl_setopt_array($ch, [
@@ -30,6 +41,7 @@ PluginManager::instance()->onApiRoute(function (string $route, string $method) {
         CURLOPT_USERAGENT      => 'Mozilla/5.0 (compatible; hyprcrd-bookmarks/1.0)',
         CURLOPT_SSL_VERIFYPEER => true,
     ]);
+    hyprcrdApplySafeCurlOpts($ch);
     $html = curl_exec($ch);
     $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
     $finalUrl = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL) ?: $url;
@@ -63,18 +75,21 @@ PluginManager::instance()->onApiRoute(function (string $route, string $method) {
     }
 
     $faviconData = '';
-    $ch2 = curl_init($faviconUrl);
+    $faviconScheme = strtolower((string)parse_url($faviconUrl, PHP_URL_SCHEME));
-    curl_setopt_array($ch2, [
+    $favCh = ($faviconScheme === 'http' || $faviconScheme === 'https') && hyprcrdUrlHostIsPublic($faviconUrl);
+    $ch2 = $favCh ? curl_init($faviconUrl) : null;
+    if ($ch2) curl_setopt_array($ch2, [
         CURLOPT_RETURNTRANSFER => true,
         CURLOPT_FOLLOWLOCATION => true,
         CURLOPT_MAXREDIRS      => 3,
         CURLOPT_TIMEOUT        => 5,
         CURLOPT_USERAGENT      => 'Mozilla/5.0 (compatible; hyprcrd-bookmarks/1.0)',
     ]);
-    $favBytes = curl_exec($ch2);
+    if ($ch2) hyprcrdApplySafeCurlOpts($ch2);
-    $favStatus = curl_getinfo($ch2, CURLINFO_HTTP_CODE);
+    $favBytes = $ch2 ? curl_exec($ch2) : false;
-    $favMime = curl_getinfo($ch2, CURLINFO_CONTENT_TYPE) ?: 'image/x-icon';
+    $favStatus = $ch2 ? curl_getinfo($ch2, CURLINFO_HTTP_CODE) : 0;
-    curl_close($ch2);
+    $favMime = $ch2 ? (curl_getinfo($ch2, CURLINFO_CONTENT_TYPE) ?: 'image/x-icon') : 'image/x-icon';
+    if ($ch2) curl_close($ch2);
 
     if ($favBytes && $favStatus >= 200 && $favStatus < 400 && strlen($favBytes) <= 32768) {
         $mime = preg_replace('/;.*$/', '', $favMime);

public/plugins/chat/backend.php

@@ -108,24 +108,20 @@ function chatRelaySettings(): array {
     ];
 }
 
-/** Same envelope format as the existing relay sync (HYPRCRD-RELAY-V1). */
+/** Dual-format envelope shared with the relay sync path. Writes V2
+ *  (AES-GCM + HKDF), reads V2 + legacy V1 (CBC). Delegates to the central
+ *  helpers so the format stays in lock-step with src/bootstrap.php and
+ *  the relay's crypto.php. */
 function chatEncrypt(string $plain, string $relayKey): string {
-    $encKey = substr(hash('sha256', $relayKey), 0, 32);
+    return hyprcrdRelayEncrypt($plain, $relayKey);
-    $iv = random_bytes(16);
-    $cipher = openssl_encrypt($plain, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
-    return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher);
 }
 
 function chatDecrypt(string $envelope, string $relayKey): string {
-    if (!str_starts_with($envelope, 'HYPRCRD-RELAY-V1')) return '';
+    // Old behaviour returned '' for non-envelope strings; preserve that.
-    $b64 = trim(substr($envelope, strlen('HYPRCRD-RELAY-V1') + 1));
+    if (!str_starts_with($envelope, HYPRCRD_RELAY_GCM_MAGIC) && !str_starts_with($envelope, HYPRCRD_RELAY_CBC_MAGIC)) {
-    $raw = base64_decode($b64);
+        return '';
-    if (!$raw || strlen($raw) < 17) return '';
+    }
-    $encKey = substr(hash('sha256', $relayKey), 0, 32);
+    return hyprcrdRelayDecrypt($envelope, $relayKey);
-    $iv = substr($raw, 0, 16);
-    $cipher = substr($raw, 16);
-    $result = openssl_decrypt($cipher, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
-    return $result !== false ? $result : '';
 }
 
 function chatGetState(string $key, $default = null) {

public/plugins/collab-buckets/backend.php

@@ -110,32 +110,24 @@
     ");
 })();
 
-/** Encrypt a JSON payload with the local relay_key using the same envelope
+/** Encrypt a JSON payload with the local relay_key using the shared
- * format the rest of hyprcrd uses (HYPRCRD-RELAY-V1). */
+ * dual-format envelope (GCM-V2 writes, V1 read-only fallback lives in
+ * hyprcrdRelayDecrypt). */
 function collabEncryptPayload(array $fields): ?string {
     $key = collabRelaySettings()['key'] ?? '';
     if ($key === '') return null;
-    $encKey = substr(hash('sha256', $key), 0, 32);
     $plain = json_encode($fields);
-    $iv = random_bytes(16);
+    if ($plain === false) return null;
-    $cipher = openssl_encrypt($plain, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
+    return hyprcrdRelayEncrypt($plain, $key);
-    if ($cipher === false) return null;
-    return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher);
 }
 
 /** Decrypt the inverse. Returns an associative array, or null on failure. */
 function collabDecryptPayload(string $envelope): ?array {
-    if (!str_starts_with($envelope, 'HYPRCRD-RELAY-V1')) return null;
+    if (!str_starts_with($envelope, HYPRCRD_RELAY_GCM_MAGIC) && !str_starts_with($envelope, HYPRCRD_RELAY_CBC_MAGIC)) return null;
-    $b64 = trim(substr($envelope, strlen('HYPRCRD-RELAY-V1') + 1));
-    $raw = base64_decode($b64);
-    if (!$raw || strlen($raw) < 17) return null;
     $key = collabRelaySettings()['key'] ?? '';
     if ($key === '') return null;
-    $encKey = substr(hash('sha256', $key), 0, 32);
+    $plain = hyprcrdRelayDecrypt($envelope, $key);
-    $iv = substr($raw, 0, 16);
+    if ($plain === '') return null;
-    $cipher = substr($raw, 16);
-    $plain = openssl_decrypt($cipher, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
-    if ($plain === false) return null;
     $data = json_decode($plain, true);
     return is_array($data) ? $data : null;
 }

public/plugins/tests/relay.test.js

@@ -3,8 +3,10 @@ import { describe, it, expect, csrf } from './runner.js?v=4';
 describe('Relay: Push API', () => {
     it('push without config returns error', async () => {
         const settings = await fetch('api/relay/settings').then(r => r.json());
-        // The GET endpoint echoes the secret directly as `key` (single-user local app).
+        // GET only reports `has_key` (boolean) — the secret itself is never
-        if (settings.url && settings.key) return; // skip if configured
+        // echoed. If a relay is configured the real push may succeed or fail
+        // for other reasons, so skip in that case.
+        if (settings.url && settings.has_key) return; // skip if configured
 
         const res = await fetch('api/relay/push', {
             method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
@@ -16,7 +18,7 @@ describe('Relay: Push API', () => {
 
     it('push without card_id returns error', async () => {
         const settings = await fetch('api/relay/settings').then(r => r.json());
-        if (!settings.url || !settings.key) return; // card_id check is after config check
+        if (!settings.url || !settings.has_key) return; // card_id check is after config check
         const res = await fetch('api/relay/push', {
             method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
             body: JSON.stringify({}),
@@ -28,7 +30,7 @@ describe('Relay: Push API', () => {
 describe('Relay: Poll API', () => {
     it('poll without config returns 0 pulled', async () => {
         const settings = await fetch('api/relay/settings').then(r => r.json());
-        if (settings.url && settings.key) return;
+        if (settings.url && settings.has_key) return;
 
         const res = await fetch('api/relay/poll', {
             method: 'POST', headers: { 'X-CSRF-Token': csrf() },

relay/inc/bootstrap.php

@@ -395,6 +395,34 @@ $db->exec('CREATE TABLE IF NOT EXISTS rate_limits (
     attempted_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
 )');
 
+// ── v3.x → v1.10 crypto migration ────────────────────────────────
+// Re-encrypt master-wrapped secrets (tenant client secrets + inter-tenant
+// key) from CBC-V1 to GCM-V2. This only touches data we already hold the
+// master key for, so no user action is needed and no secrets change —
+// only the envelope around them. Idempotent: rows already in V2 skip.
+require_once __DIR__ . '/crypto.php';
+if (tableExists($db, 'tenants')) {
+    $legacyTenantRows = $db->query("SELECT id, secret_encrypted FROM tenants WHERE secret_encrypted IS NOT NULL AND secret_encrypted != '' AND secret_encrypted NOT LIKE '" . HYPRCRD_GCM_MAGIC_MASTER . "%'")->fetchAll();
+    if ($legacyTenantRows) {
+        $upd = $db->prepare('UPDATE tenants SET secret_encrypted = :s WHERE id = :i');
+        foreach ($legacyTenantRows as $r) {
+            $plain = masterDecrypt($r['secret_encrypted'], $MASTER_KEY);
+            if ($plain !== '') {
+                $upd->execute(['s' => masterEncrypt($plain, $MASTER_KEY), 'i' => $r['id']]);
+            }
+        }
+        @error_log('[hyprcrd-relay] migrated ' . count($legacyTenantRows) . ' tenant secret_encrypted rows to GCM-V2');
+    }
+    $legacyItk = $db->query("SELECT value FROM settings WHERE key = 'inter_tenant_key'")->fetchColumn();
+    if ($legacyItk && !str_starts_with($legacyItk, HYPRCRD_GCM_MAGIC_MASTER)) {
+        $plainItk = masterDecrypt($legacyItk, $MASTER_KEY);
+        if ($plainItk !== '') {
+            setInterTenantKey($db, $MASTER_KEY, $plainItk);
+            @error_log('[hyprcrd-relay] migrated inter-tenant key to GCM-V2');
+        }
+    }
+}
+
 // Cleanup: 24h ephemeral storage, expired sessions, old rate limits
 $db->exec("DELETE FROM messages WHERE created_at < datetime('now', '-24 hours')");
 $db->exec("DELETE FROM attachments WHERE created_at < datetime('now', '-24 hours')");

relay/inc/crypto.php

@@ -1,24 +1,54 @@
 <?php
-// Crypto helpers: at-rest encryption with master key, plus the
+// Crypto helpers.
-// HYPRCRD-RELAY-V1 envelope format used by both the JS client and
+//
-// the relay's internal re-encryption hops.
+// Two envelope formats coexist during the v1.10 rollout:
+//
+//   HYPRCRD-GCM-V2   — new: AES-256-GCM, per-ciphertext random salt + HKDF
+//                      (authenticated, standard). Used for every new write.
+//   HYPRCRD-RELAY-V1 — legacy: AES-256-CBC, substr(hex(sha256(secret))) as a
+//                      32-byte ASCII key, no MAC. Dual-read only.
+//
+// For at-rest master-key encryption the legacy format carries no magic
+// prefix (raw base64(iv || cipher)). The new format uses HYPRCRD-MGCM-V2.
+//
+// Same user secret works across both formats — only the KDF and cipher
+// differ. Old data stays readable forever via the V1 fallback; new data
+// is authenticated and cannot be silently mutated.
 
 if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
 
+const HYPRCRD_GCM_MAGIC_CLIENT = 'HYPRCRD-GCM-V2';
+const HYPRCRD_CBC_MAGIC_CLIENT = 'HYPRCRD-RELAY-V1';
+const HYPRCRD_GCM_MAGIC_MASTER = 'HYPRCRD-MGCM-V2';
+const HYPRCRD_HKDF_INFO_CLIENT = 'hyprcrd-relay-client-v2';
+
 /**
- * Encrypt a value at-rest with the master key. Used for tenant secrets
+ * Encrypt a value at-rest with the master key. The master key is already
- * and the inter-tenant key in the DB.
+ * cryptographically random (32 raw bytes), so no KDF stretching is needed —
+ * a fresh 12-byte nonce per ciphertext is enough for GCM.
  */
 function masterEncrypt(string $plain, string $masterKeyHex): string {
     $key = hex2bin($masterKeyHex);
-    $iv = random_bytes(16);
+    $nonce = random_bytes(12);
-    $cipher = openssl_encrypt($plain, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+    $tag = '';
-    return base64_encode($iv . $cipher);
+    $cipher = openssl_encrypt($plain, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag, '', 16);
+    return HYPRCRD_GCM_MAGIC_MASTER . "\n" . base64_encode($nonce . $cipher . $tag);
 }
 
 function masterDecrypt(string $encoded, string $masterKeyHex): string {
     $key = hex2bin($masterKeyHex);
-    $raw = base64_decode($encoded);
+    if (str_starts_with($encoded, HYPRCRD_GCM_MAGIC_MASTER)) {
+        $b64 = trim(substr($encoded, strlen(HYPRCRD_GCM_MAGIC_MASTER) + 1));
+        $raw = base64_decode($b64, true);
+        if (!$raw || strlen($raw) < 12 + 16 + 1) return '';
+        $nonce = substr($raw, 0, 12);
+        $tag = substr($raw, -16);
+        $cipher = substr($raw, 12, -16);
+        $plain = openssl_decrypt($cipher, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag);
+        return $plain !== false ? $plain : '';
+    }
+    // Legacy: base64(iv(16) || ciphertext) under AES-256-CBC, no prefix.
+    $raw = base64_decode($encoded, true);
     if (!$raw || strlen($raw) < 17) return '';
     $iv = substr($raw, 0, 16);
     $cipher = substr($raw, 16);
@@ -26,27 +56,48 @@ function masterDecrypt(string $encoded, string $masterKeyHex): string {
 }
 
 /**
- * Match the JS client's encryption format exactly:
+ * Encrypt with a user-chosen secret (client API "shared secret" and the
- *   key = first 32 chars of hex(SHA-256(secret)) used as 32-byte ASCII key
+ * relay-wide inter-tenant key). V2 format:
- *   envelope = "HYPRCRD-RELAY-V1\n" + base64(iv || ciphertext)
+ *   magic "\n" base64( salt(16) || nonce(12) || ciphertext || tag(16) )
+ * Per-ciphertext salt feeds HKDF(SHA-256) to derive a fresh 32-byte subkey
+ * — defeats the weak legacy substr-of-hex KDF and removes cross-tenant
+ * key collisions for identical secrets.
  */
 function clientEncrypt(string $plain, string $secret): string {
-    $key = substr(hash('sha256', $secret), 0, 32);
+    $salt = random_bytes(16);
-    $iv = random_bytes(16);
+    $nonce = random_bytes(12);
-    $cipher = openssl_encrypt($plain, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+    $key = hash_hkdf('sha256', $secret, 32, HYPRCRD_HKDF_INFO_CLIENT, $salt);
-    return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher);
+    $tag = '';
+    $cipher = openssl_encrypt($plain, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag, '', 16);
+    return HYPRCRD_GCM_MAGIC_CLIENT . "\n" . base64_encode($salt . $nonce . $cipher . $tag);
 }
 
 function clientDecrypt(string $envelope, string $secret): string {
-    if (!str_starts_with($envelope, 'HYPRCRD-RELAY-V1')) return $envelope;
+    if (str_starts_with($envelope, HYPRCRD_GCM_MAGIC_CLIENT)) {
-    $b64 = trim(substr($envelope, strlen('HYPRCRD-RELAY-V1') + 1));
+        $b64 = trim(substr($envelope, strlen(HYPRCRD_GCM_MAGIC_CLIENT) + 1));
-    $raw = base64_decode($b64);
+        $raw = base64_decode($b64, true);
+        if (!$raw || strlen($raw) < 16 + 12 + 16 + 1) return '';
+        $salt = substr($raw, 0, 16);
+        $nonce = substr($raw, 16, 12);
+        $tag = substr($raw, -16);
+        $cipher = substr($raw, 28, -16);
+        $key = hash_hkdf('sha256', $secret, 32, HYPRCRD_HKDF_INFO_CLIENT, $salt);
+        $plain = openssl_decrypt($cipher, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag);
+        return $plain !== false ? $plain : '';
+    }
+    if (str_starts_with($envelope, HYPRCRD_CBC_MAGIC_CLIENT)) {
+        $b64 = trim(substr($envelope, strlen(HYPRCRD_CBC_MAGIC_CLIENT) + 1));
+        $raw = base64_decode($b64, true);
         if (!$raw || strlen($raw) < 17) return '';
         $key = substr(hash('sha256', $secret), 0, 32);
         $iv = substr($raw, 0, 16);
         $cipher = substr($raw, 16);
         $result = openssl_decrypt($cipher, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
         return $result !== false ? $result : '';
+    }
+    // Neither envelope — passthrough. Preserves the old behaviour where
+    // already-plaintext fields flowed through unchanged.
+    return $envelope;
 }
 
 /**
@@ -54,8 +105,7 @@ function clientDecrypt(string $envelope, string $secret): string {
  * during initial setup (it's the third field in the setup form). Used to
  * re-encrypt messages at rest so they can be routed between tenants.
  *
- * Returns null if not set yet (e.g. legacy v2 installs that haven't been
+ * Returns null if not set yet.
- * upgraded through the new setup wizard).
  */
 function getInterTenantKey(PDO $db, string $masterKey): ?string {
     $stored = $db->query("SELECT value FROM settings WHERE key = 'inter_tenant_key'")->fetchColumn();

relay/inc/routes/account.php

@@ -52,11 +52,14 @@ if ($route === '/api/account/secret' && $method === 'DELETE') {
 
 if ($route === '/api/account/password' && $method === 'POST') {
     if (!$sessionTenant) jsonResponse(['error' => 'not logged in'], 401);
+    // Rate-limit password changes — a stolen session cookie could otherwise
+    // brute-force the `current` field server-side with no friction.
+    if (isRateLimited($db, 'account-password', 10)) jsonResponse(['error' => 'too many attempts'], 429);
     $input = json_decode(file_get_contents('php://input'), true) ?: [];
     $current = (string)($input['current'] ?? '');
     $new = (string)($input['new'] ?? '');
 
-    if (strlen($new) < 4) jsonResponse(['error' => 'new password must be at least 4 chars'], 400);
+    if (strlen($new) < 10) jsonResponse(['error' => 'new password must be at least 10 chars'], 400);
     if (!password_verify($current, $sessionTenant['password_hash'])) {
         jsonResponse(['error' => 'current password is wrong'], 401);
     }

relay/inc/routes/admin.php

@@ -28,7 +28,7 @@ if ($route === '/api/users' && $method === 'POST') {
     if (!preg_match('/^[a-zA-Z0-9_-]{2,32}$/', $username)) {
         jsonResponse(['error' => 'username must be 2-32 chars: letters, digits, _ or -'], 400);
     }
-    if (strlen($password) < 4) jsonResponse(['error' => 'password must be at least 4 chars'], 400);
+    if (strlen($password) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400);
     if (getTenantByUsername($db, $username)) jsonResponse(['error' => 'username already exists'], 409);
 
     // No client secret — the new user sets that themselves after first login
@@ -53,7 +53,7 @@ if (preg_match('#^/api/users/(\d+)$#', $route, $m) && $method === 'PATCH') {
     $input = json_decode(file_get_contents('php://input'), true) ?: [];
     $fields = []; $params = ['id' => $id];
     if (!empty($input['password'])) {
-        if (strlen($input['password']) < 4) jsonResponse(['error' => 'password too short'], 400);
+        if (strlen($input['password']) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400);
         $fields[] = 'password_hash = :pw';
         $params['pw'] = password_hash($input['password'], PASSWORD_BCRYPT);
     }

relay/inc/routes/chat.php

@@ -93,7 +93,7 @@ if ($route === '/api/chat/send' && $method === 'POST' && $sessionTenant) {
     if ($body === '') jsonResponse(['error' => 'body required'], 400);
     if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
     $interKey = getInterTenantKey($db, $MASTER_KEY);
     if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
     $stored = clientEncrypt($body, $interKey);
@@ -122,7 +122,7 @@ if ($route === '/api/sync-events' && $method === 'POST') {
     if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
     if ($recipientName === $clientTenant['username']) jsonResponse(['ok' => true, 'id' => 0]); // suppress self-notifications
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
     $db->prepare('INSERT INTO relay_sync_events (recipient_id, sender_username, body) VALUES (:r, :sn, :b)')
         ->execute(['r' => $recipient['id'], 'sn' => $clientTenant['username'], 'b' => $body]);
     jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId()]);
@@ -193,7 +193,8 @@ if ($route === '/api/chat/rooms' && $method === 'POST') {
         $db->commit();
     } catch (Throwable $e) {
         if ($db->inTransaction()) $db->rollBack();
-        jsonResponse(['error' => 'create failed: ' . $e->getMessage()], 500);
+        @error_log('[hyprcrd-relay] chat room create failed: ' . $e->getMessage());
+        jsonResponse(['error' => 'create failed'], 500);
     }
     jsonResponse(['ok' => true, 'uid' => $uid, 'members' => array_values($resolved)]);
 }
@@ -306,7 +307,7 @@ if ($route === '/api/chat' && $method === 'POST') {
             ->execute(['me' => $clientTenant['id'], 's' => $clientTenant['id'], 'sn' => $clientTenant['username'], 'ru' => $roomUid, 'b' => $stored]);
     } else {
         $recipient = getTenantByUsername($db, $recipientName);
-        if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+        if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
         $db->prepare('INSERT INTO chat_messages (recipient_id, sender_id, sender_username, body, persistent) VALUES (:r, :s, :sn, :b, :p)')
             ->execute([
                 'r' => $recipient['id'],
@@ -417,7 +418,7 @@ if ($route === '/api/chat/backfill' && $method === 'GET') {
         $stmt->execute();
     } else {
         $peerTenant = getTenantByUsername($db, $peer);
-        if (!$peerTenant) jsonResponse(['error' => "no such user: $peer"], 404);
+        if (!$peerTenant) jsonResponse(['error' => 'peer not found'], 404);
         $sql = "SELECT id, sender_id, sender_username, room_uid, body, created_at
                 FROM chat_messages
                 WHERE room_uid IS NULL

relay/inc/routes/collab-buckets.php

@@ -50,7 +50,8 @@ if ($route === '/api/collab-buckets' && $method === 'POST') {
         $db->commit();
     } catch (Throwable $e) {
         if ($db->inTransaction()) $db->rollBack();
-        jsonResponse(['error' => 'create failed: ' . $e->getMessage()], 500);
+        @error_log('[hyprcrd-relay] collab bucket create failed: ' . $e->getMessage());
+        jsonResponse(['error' => 'create failed'], 500);
     }
     jsonResponse(['ok' => true, 'uid' => $uid, 'members' => array_values($resolved)]);
 }
@@ -102,7 +103,7 @@ if (preg_match('#^/api/collab-buckets/([a-zA-Z0-9_-]+)$#', $route, $m) && $metho
         $newOwnerName = trim((string)$input['owner']);
         if ($newOwnerName === '') jsonResponse(['error' => 'owner cannot be empty'], 400);
         $newOwner = getTenantByUsername($db, $newOwnerName);
-        if (!$newOwner) jsonResponse(['error' => "no such user: $newOwnerName"], 404);
+        if (!$newOwner) jsonResponse(['error' => 'user not found'], 404);
         $memCheck = $db->prepare('SELECT 1 FROM collab_bucket_members WHERE bucket_uid = :b AND tenant_id = :t');
         $memCheck->execute(['b' => $uid, 't' => $newOwner['id']]);
         if (!$memCheck->fetchColumn()) {

relay/inc/routes/collab-cards.php

@@ -243,6 +243,14 @@ if (preg_match('#^/api/collab-cards/([a-zA-Z0-9_-]+)/([a-zA-Z0-9_-]+)$#', $route
 
 // ── Collab attachments (images/PDFs/audio referenced by collab cards) ─
 
+// Attachment filenames always follow the hyprcrd upload pattern
+// (bin2hex(random_bytes(16)).<ext>). Enforce server-side so malicious
+// clients can't poison the DB with traversal-shaped names that later
+// surface in UIs or get forwarded to filesystem APIs.
+function collabAttachmentFilenameValid(string $fn): bool {
+    return (bool)preg_match('/^[a-f0-9]{8,64}\.[a-z0-9]{1,8}$/', $fn);
+}
+
 if ($route === '/api/collab-attachments' && $method === 'POST') {
     if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
     $input = json_decode(file_get_contents('php://input'), true) ?: [];
@@ -250,6 +258,7 @@ if ($route === '/api/collab-attachments' && $method === 'POST') {
     $filename = (string)($input['filename'] ?? '');
     $data = (string)($input['data'] ?? '');
     if (!$bucketUid || !$filename || !$data) jsonResponse(['error' => 'bucket_uid, filename, and data required'], 400);
+    if (!collabAttachmentFilenameValid($filename)) jsonResponse(['error' => 'invalid filename'], 400);
     if (!collabCardsIsMember($db, $bucketUid, (int)$clientTenant['id'])) {
         jsonResponse(['error' => 'not a member of this bucket'], 403);
     }
@@ -277,6 +286,7 @@ if ($route === '/api/collab-attachments' && $method === 'GET') {
     $bucketUid = trim($_GET['bucket_uid'] ?? '');
     $filename = trim($_GET['filename'] ?? '');
     if (!$bucketUid) jsonResponse(['error' => 'bucket_uid required'], 400);
+    if ($filename !== '' && !collabAttachmentFilenameValid($filename)) jsonResponse(['error' => 'invalid filename'], 400);
     if (!collabCardsIsMember($db, $bucketUid, (int)$clientTenant['id'])) {
         jsonResponse(['error' => 'not a member of this bucket'], 403);
     }

relay/inc/routes/collab-locks.php

@@ -20,6 +20,13 @@ function collabLocksIsMember(PDO $db, string $bucketUid, int $tenantId): bool {
 
 // ── POST: acquire/refresh ────────────────────────────────────────
 
+// Maximum time a single holder can keep refreshing the same lock. Without a
+// cap a malicious member could heartbeat forever, blocking every other
+// member's writes. 10 minutes is long enough for any real edit session and
+// short enough to time-box grief. When the cap is hit the lock is force-
+// released and the client must re-acquire — giving everyone else a window.
+const COLLAB_LOCK_MAX_HOLD_SECONDS = 600;
+
 if ($route === '/api/collab-locks' && $method === 'POST') {
     if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
     if (isRateLimited($db, 'collab-locks-post', 240)) jsonResponse(['error' => 'rate limited'], 429);
@@ -35,8 +42,12 @@ if ($route === '/api/collab-locks' && $method === 'POST') {
     // narrow window between cleanup and this query.
     $db->prepare("DELETE FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c AND expires_at <= datetime('now')")
         ->execute(['b' => $bucketUid, 'c' => $cardUid]);
+    // Also drop locks that have been refreshed past the max hold window —
+    // cap enforcement for grief prevention.
+    $db->prepare("DELETE FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c AND acquired_at <= datetime('now', '-" . COLLAB_LOCK_MAX_HOLD_SECONDS . " seconds')")
+        ->execute(['b' => $bucketUid, 'c' => $cardUid]);
     // Existing live lock? If a different tenant holds it, refuse.
-    $cur = $db->prepare('SELECT holder_id, holder_username, expires_at FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c');
+    $cur = $db->prepare('SELECT holder_id, holder_username, expires_at, acquired_at FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c');
     $cur->execute(['b' => $bucketUid, 'c' => $cardUid]);
     $existing = $cur->fetch();
     if ($existing && (int)$existing['holder_id'] !== (int)$clientTenant['id']) {

relay/inc/routes/messages.php

@@ -21,7 +21,7 @@ if ($route === '/api/messages' && $method === 'POST' && $sessionTenant && empty(
     if ($body === '') jsonResponse(['error' => 'body required'], 400);
 
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
 
     $interKey = getInterTenantKey($db, $MASTER_KEY);
     if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
@@ -54,7 +54,7 @@ if ($route === '/api/attachments/upload' && $method === 'POST' && $sessionTenant
     if (!$relayUid) jsonResponse(['error' => 'relay_uid required'], 400);
 
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
 
     $interKey = getInterTenantKey($db, $MASTER_KEY);
     if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
@@ -142,7 +142,7 @@ if ($route === '/api/messages' && $method === 'POST') {
     if ($encryptedBody === '') jsonResponse(['error' => 'body required'], 400);
 
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
 
     // Decrypt with sender's secret
     if (empty($clientTenant['secret_encrypted'])) {
@@ -225,9 +225,12 @@ if ($route === '/api/attachments' && $method === 'POST') {
     $data = (string)($input['data'] ?? '');
     $recipientName = trim((string)($input['recipient'] ?? $clientTenant['username']));
     if (!$relayUid || !$filename || !$data) jsonResponse(['error' => 'relay_uid, filename, and data required'], 400);
+    // Enforce the hyprcrd upload naming scheme server-side so traversal-shaped
+    // names never enter storage or get forwarded back to other clients.
+    if (!preg_match('/^[a-f0-9]{8,64}\.[a-z0-9]{1,8}$/', $filename)) jsonResponse(['error' => 'invalid filename'], 400);
 
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
 
     // Decrypt-reencrypt hop, same shape as messages: arrives encrypted with
     // sender's secret, gets stored at-rest under the inter-tenant key.

relay/inc/routes/public.php

@@ -49,7 +49,7 @@ if ($route === '/api/setup' && $method === 'POST') {
     if (!preg_match('/^[a-zA-Z0-9_-]{2,32}$/', $username)) {
         jsonResponse(['error' => 'username must be 2-32 chars: letters, digits, _ or -'], 400);
     }
-    if (strlen($password) < 4) jsonResponse(['error' => 'password must be at least 4 chars'], 400);
+    if (strlen($password) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400);
     if (strlen($superSecret) < 12) jsonResponse(['error' => 'super-shared secret must be at least 12 chars'], 400);
 
     // Create the admin tenant. NO client secret yet — the admin (and every

relay/index.php

@@ -40,10 +40,25 @@ $isSetup = tenantCount($db) === 0;
 
 if (str_starts_with($route, '/api/')) {
     header('Content-Type: application/json');
+    // CORS: the hyprcrd client hits us server-side (no browser CORS in play)
+    // and the relay UI lives same-origin, so the only legitimate cross-origin
+    // callers are other tenant UIs on the same relay host. We allow the
+    // relay's own scheme+host, plus an opt-in allowlist via RELAY_CORS_ORIGINS
+    // (comma-separated). Credentials are intentionally NOT allowed — API auth
+    // is header-based (X-Relay-User/Key) and the UI is same-origin.
     $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
-    if ($origin) {
+    $ownScheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https' ? 'https' : 'http';
+    $ownOrigin = $ownScheme . '://' . ($_SERVER['HTTP_HOST'] ?? '');
+    $allowed = [$ownOrigin];
+    $extra = getenv('RELAY_CORS_ORIGINS');
+    if ($extra) {
+        foreach (explode(',', $extra) as $o) {
+            $o = trim($o);
+            if ($o !== '') $allowed[] = $o;
+        }
+    }
+    if ($origin && in_array($origin, $allowed, true)) {
         header('Access-Control-Allow-Origin: ' . $origin);
-        header('Access-Control-Allow-Credentials: true');
         header('Vary: Origin');
     }
     header('Access-Control-Allow-Headers: Content-Type, X-Relay-User, X-Relay-Key');

relay/ui/app.js

@@ -199,7 +199,7 @@ async function doChangePassword() {
     const err = $('cp-err');
     err.textContent = '';
     if (!current || !newPw) { err.textContent = 'all fields required'; return; }
-    if (newPw.length < 4) { err.textContent = 'new password too short'; return; }
+    if (newPw.length < 10) { err.textContent = 'new password must be at least 10 chars'; return; }
     if (newPw !== newPw2) { err.textContent = 'new passwords don\'t match'; return; }
     if (current === newPw) { err.textContent = 'new password must differ from current'; return; }
 
@@ -231,7 +231,7 @@ async function doSetup() {
     const err = $('setup-err');
     err.textContent = '';
     if (!username) { err.textContent = 'username required'; return; }
-    if (password.length < 4) { err.textContent = 'password too short'; return; }
+    if (password.length < 10) { err.textContent = 'password must be at least 10 chars'; return; }
     if (superSecret.length < 12) { err.textContent = 'super-shared secret needs at least 12 chars'; return; }
     const res = await api('api/setup', { method: 'POST', body: { username, password, super_secret: superSecret } });
     if (res.ok) {
@@ -1039,8 +1039,8 @@ async function createUser() {
 }
 
 async function resetUserPassword(id, username) {
-    const newPw = prompt(`new password for ${username} (min 4 chars):`);
+    const newPw = prompt(`new password for ${username} (min 10 chars):`);
-    if (!newPw || newPw.length < 4) { toast('password too short', true); return; }
+    if (!newPw || newPw.length < 10) { toast('password too short', true); return; }
     const res = await api('api/users/' + id, { method: 'PATCH', body: { password: newPw } });
     if (res.ok) toast('password updated');
     else toast(res.error || 'failed', true);

relay/ui/layout.php

@@ -47,7 +47,7 @@ if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
     </div>
     <div class="field">
         <label>admin password</label>
-        <input type="password" id="setup-password" placeholder="min 4 chars" autocomplete="new-password">
+        <input type="password" id="setup-password" placeholder="min 10 chars" autocomplete="new-password">
     </div>
     <div class="field">
         <label>super-shared secret</label>
@@ -144,7 +144,7 @@ if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
     </div>
     <div class="field">
         <label>new password</label>
-        <input type="password" id="cp-new" placeholder="min 4 chars" autocomplete="new-password">
+        <input type="password" id="cp-new" placeholder="min 10 chars" autocomplete="new-password">
     </div>
     <div class="field">
         <label>confirm new password</label>
@@ -205,7 +205,7 @@ if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
             </div>
             <div class="field">
                 <label for="new-password">password</label>
-                <input type="password" id="new-password" placeholder="min 4 chars" autocomplete="new-password">
+                <input type="password" id="new-password" placeholder="min 10 chars" autocomplete="new-password">
             </div>
             <label class="checkbox">
                 <input type="checkbox" id="new-is-admin"> grant admin privileges

src/CalDavClient.php

@@ -28,6 +28,7 @@ class CalDavClient
             CURLOPT_TIMEOUT => 30,
             CURLOPT_SSL_VERIFYPEER => true,
         ]);
+        hyprcrdApplySafeCurlOpts($ch);
         if ($body !== '') {
             curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
         }

src/Database.php

@@ -169,5 +169,17 @@ class Database
             )
         ');
         self::$pdo->exec('CREATE INDEX IF NOT EXISTS idx_card_history_card ON card_history(card_id, changed_at DESC)');
+
+        // Login / password-change rate limiting. Keyed by IP so rotating the
+        // session cookie doesn't reset the counter. Old rows are purged at
+        // the top of every login request.
+        self::$pdo->exec('
+            CREATE TABLE IF NOT EXISTS login_attempts (
+                ip TEXT NOT NULL,
+                endpoint TEXT NOT NULL,
+                attempted_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+            )
+        ');
+        self::$pdo->exec('CREATE INDEX IF NOT EXISTS idx_login_attempts_ip_ep ON login_attempts(ip, endpoint, attempted_at)');
     }
 }

src/bootstrap.php

@@ -23,3 +23,95 @@ $pluginManager = PluginManager::instance();
 $pluginManager->scan(__DIR__ . '/../public/plugins');
 $pluginManager->loadDisabled(dirname(DB_PATH) . '/plugins.json');
 $pluginManager->loadBackends(); // require_once enabled backend.php files
+
+// ── SSRF guards ────────────────────────────────────────────────────
+// Used by every outbound cURL that fetches a user-supplied URL.
+// Default: restrict protocols to HTTP(S); caller opts into private-IP
+// blocking when the target should be public-internet-only (bookmarks).
+
+if (!defined('HYPRCRD_SAFE_PROTOS')) {
+    define('HYPRCRD_SAFE_PROTOS', CURLPROTO_HTTP | CURLPROTO_HTTPS);
+}
+
+function hyprcrdApplySafeCurlOpts($ch): void {
+    curl_setopt($ch, CURLOPT_PROTOCOLS, HYPRCRD_SAFE_PROTOS);
+    curl_setopt($ch, CURLOPT_REDIR_PROTOCOLS, HYPRCRD_SAFE_PROTOS);
+}
+
+// ── Relay wire crypto ──────────────────────────────────────────────
+// Dual-format envelope used by the relay push/poll path. Mirrors
+// relay/inc/crypto.php exactly — same magic strings, same HKDF info.
+//
+//   HYPRCRD-GCM-V2   (new)    AES-256-GCM + HKDF(SHA-256) + per-cipher salt
+//   HYPRCRD-RELAY-V1 (legacy) AES-256-CBC + substr(hex(sha256())) KDF
+//
+// Encrypt always writes V2. Decrypt accepts either so hyprcrd keeps
+// reading messages and attachments pushed before the v1.10 upgrade.
+
+const HYPRCRD_RELAY_GCM_MAGIC = 'HYPRCRD-GCM-V2';
+const HYPRCRD_RELAY_CBC_MAGIC = 'HYPRCRD-RELAY-V1';
+const HYPRCRD_RELAY_HKDF_INFO = 'hyprcrd-relay-client-v2';
+
+function hyprcrdRelayEncrypt(string $plain, string $secret): string {
+    $salt = random_bytes(16);
+    $nonce = random_bytes(12);
+    $key = hash_hkdf('sha256', $secret, 32, HYPRCRD_RELAY_HKDF_INFO, $salt);
+    $tag = '';
+    $cipher = openssl_encrypt($plain, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag, '', 16);
+    return HYPRCRD_RELAY_GCM_MAGIC . "\n" . base64_encode($salt . $nonce . $cipher . $tag);
+}
+
+function hyprcrdRelayDecrypt(string $envelope, string $secret): string {
+    if (str_starts_with($envelope, HYPRCRD_RELAY_GCM_MAGIC)) {
+        $b64 = trim(substr($envelope, strlen(HYPRCRD_RELAY_GCM_MAGIC) + 1));
+        $raw = base64_decode($b64, true);
+        if (!$raw || strlen($raw) < 16 + 12 + 16 + 1) return '';
+        $salt = substr($raw, 0, 16);
+        $nonce = substr($raw, 16, 12);
+        $tag = substr($raw, -16);
+        $cipher = substr($raw, 28, -16);
+        $key = hash_hkdf('sha256', $secret, 32, HYPRCRD_RELAY_HKDF_INFO, $salt);
+        $plain = openssl_decrypt($cipher, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag);
+        return $plain !== false ? $plain : '';
+    }
+    if (str_starts_with($envelope, HYPRCRD_RELAY_CBC_MAGIC)) {
+        $b64 = trim(substr($envelope, strlen(HYPRCRD_RELAY_CBC_MAGIC) + 1));
+        $raw = base64_decode($b64, true);
+        if (!$raw || strlen($raw) < 17) return '';
+        $key = substr(hash('sha256', $secret), 0, 32);
+        $iv = substr($raw, 0, 16);
+        $cipher = substr($raw, 16);
+        $result = openssl_decrypt($cipher, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+        return $result !== false ? $result : '';
+    }
+    // Passthrough for already-plaintext fields (legacy relays occasionally
+    // returned title fields unwrapped).
+    return $envelope;
+}
+
+function hyprcrdUrlHostIsPublic(string $url): bool {
+    $host = parse_url($url, PHP_URL_HOST);
+    if (!$host) return false;
+    $host = strtolower(trim($host, '[]'));
+    $ips = [];
+    if (filter_var($host, FILTER_VALIDATE_IP)) {
+        $ips[] = $host;
+    } else {
+        $rec = @dns_get_record($host, DNS_A + DNS_AAAA);
+        foreach ($rec ?: [] as $r) {
+            if (!empty($r['ip'])) $ips[] = $r['ip'];
+            if (!empty($r['ipv6'])) $ips[] = $r['ipv6'];
+        }
+        if (!$ips) {
+            $resolved = @gethostbynamel($host);
+            if ($resolved) $ips = $resolved;
+        }
+    }
+    if (!$ips) return false;
+    foreach ($ips as $ip) {
+        if (!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
+            return false;
+        }
+    }
+    return true;
+}