Pre main dev

[bvtmsr]

Canvas nesting, UI changes

[dryrunsecurity]

This pull request contains multiple security vulnerabilities, including unencrypted HTTP usage, insecure CORS configuration, WebSocket security concerns, and potential information disclosure risks that could expose the system to unauthorized access and data interception.

💭 Unconfirmed Findings (5)

Vulnerability	HTTP Usage Vulnerability
Description	Critical security issue found in .env file where all URLs use unencrypted HTTP protocol instead of HTTPS, exposing network traffic to potential man-in-the-middle attacks and data interception.

Vulnerability	CORS Configuration Risk
Description	High severity security risk in configuration documentation using wildcard (*) for CORS origins, which allows unrestricted cross-origin access and potentially exposes the server to unauthorized requests.

Vulnerability	Insecure Base URL
Description	Low severity issue in cypress.config.ts using http://localhost:3000 instead of https://, representing an insecure connection protocol not suitable for production environments.

Vulnerability	WebSocket Security Concerns
Description	Multiple security vulnerabilities in WebSocket configuration including lack of explicit authentication, potential command injection risks in terminal process spawning, and overly broad permissions for terminal session creation.

Vulnerability	Potential Information Disclosure
Description	Security risk where multiple documentation files reveal internal project structure, dependencies, and configuration details that could assist potential attackers in understanding the system's architecture.

---

All finding details can be found in the DryRun Security Dashboard.