v1.1.0 - Security Hardening

Security Hardening

This release addresses security issues identified during code review.

Added

• Access control enforcement for DM and channel messages
  • DM policies: disabled, pairing, open
  • Channel policies: allowlist, denylist, all
  • Wildcard (*) support for allowing all users
• Per-user rate limiting to prevent abuse
  • Default: 5 requests per 60 seconds per user
  • Configurable via rateLimit.maxRequests and rateLimit.windowMs
• Error reference IDs for troubleshooting
  • Generic error messages sent to IRC users
  • Full details logged server-side with reference IDs
• New allowInsecureNickServ config option
• 28 new tests for authorization and rate limiting

Changed

• NickServ authentication now requires allowInsecureNickServ: true

Security Fixes

• Fixed missing access control enforcement (CRITICAL)
• Added rate limiting to prevent API abuse (HIGH)
• Sanitized error messages to prevent information disclosure (HIGH)
• Made insecure NickServ auth opt-in (MEDIUM)