jschoubben b2e29871fd Protect the address the builder sends its registry password to ...

`at` was settable. A node setting could point the builder's package binding at
any host, and the builder sends its registry credential there as basic auth — so
a setting meant for a port was a way to hand the password to somebody else.

novox/hq 04-ISSUES/085

2026-09-22 21:56:51 +02:00

..

module.json

Protect the address the builder sends its registry password to

2026-09-22 21:56:51 +02:00