Skip to content

Security: Use HTTPS for update checks#92

Open
trek-e wants to merge 2 commits intorubenwe:masterfrom
trek-e:security/fix-http-to-https-updatechecker
Open

Security: Use HTTPS for update checks#92
trek-e wants to merge 2 commits intorubenwe:masterfrom
trek-e:security/fix-http-to-https-updatechecker

Conversation

@trek-e
Copy link
Copy Markdown

@trek-e trek-e commented Jan 24, 2026

Summary

  • Changed update check URL from HTTP to HTTPS in UpdateChecker.cs
  • Prevents man-in-the-middle attacks on update checks

Security Impact

  • Severity: Medium
  • Attack Vector: Network-level MITM attack
  • Impact: Attacker could inject malicious update information, directing users to download malware

Changes

Changed http://stlvault.com/ to https://stlvault.com/ for update checks.

Test plan

  • Verify update checks still work with HTTPS
  • Verify TLS certificate validation works correctly

🤖 Generated with Claude Code

trek-e and others added 2 commits January 23, 2026 18:39
- STACK.md - Technologies and dependencies
- ARCHITECTURE.md - System design and patterns
- STRUCTURE.md - Directory layout
- CONVENTIONS.md - Code style and patterns
- TESTING.md - Test structure
- INTEGRATIONS.md - External services
- CONCERNS.md - Technical debt and issues
Changed update check URL from HTTP to HTTPS to prevent:
- Man-in-the-middle attacks that could inject malicious update info
- Eavesdropping on update check traffic

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant