amal66 locks Mike's browser access to known doors

A tighter web-access policy reduces the chance that a hostile website can read data from an authenticated Mike session.

securityinfrastructure

amal66 has replaced a permissive browser-access setting with a production allowlist: only approved web frontends can ask a browser to expose authenticated API responses.

Requests from an unrecognised website are quietly denied at the browser boundary, rather than producing noisy server errors. The change also narrows which request methods and headers a browser may use, while keeping legitimate frontend access and server-to-server use intact. Coverage checks both the approved route and the denied route, including the fact that a blocked request does not turn into a server failure.

So what Legal teams handling sensitive documents or conversations should care because this closes a common path for a malicious webpage to reach into a logged-in user's data.

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

1 commit from amal66/mike, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`3068002e`	security: production CORS allowlist with fail-safe denial	Amalanand Muthukumaran	2026-07-25	↗ GitHub
Ported from the security pack's index.ts change to the post-refactor app.ts (the Express app moved in the integration-test extraction). Adapted-from: https://github.com/Open-Legal-Products/mike/pull/227 (4c44c15, CORS half)

SHA

Subject

Author

Date

3068002e

security: production CORS allowlist with fail-safe denial

Amalanand Muthukumaran

2026-07-25

↗ GitHub

Ported from the security pack's index.ts change to the post-refactor
app.ts (the Express app moved in the integration-test extraction).
Adapted-from: https://github.com/Open-Legal-Products/mike/pull/227 (4c44c15, CORS half)

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-1325.md from inside the repo you want the changes in.