Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-21 · source-backed
146 pull requests in 13 days, and the headline fix is that every HTTP route now requires credentials unless it's in an explicit public registry. The old check worked on path prefixes, so aliases like /moderations, /models, /backends, and /mcp/chat/completions sat outside it entirely. GitHub Credit to Naor Yaacov for the report. Allowlist-by-prefix is a design that fails quietly every time someone adds a route, and if you have one in your own gateway, this is your reminder.
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source domain / Shared topic / Earlier coverage / Tension
Both cover GitHub, HTTP; reported by the same outlet (github.com); overlapping topics (check, completion, days).
Shared entities / Same source
Both cover GitHub, LocalAI; cite the same source (GitHub).
Shared entity: GitHub / Same source domain / Shared topic / Earlier coverage / Tension
Both cover GitHub; reported by the same outlet (github.com); overlapping topics (deny-by-default, fail).
Shared entity: GitHub / Same source domain / Shared topic / Earlier coverage
Both cover GitHub; reported by the same outlet (github.com); overlapping topics (chat, completion, credit).
Shared entities / Same source domain / Earlier coverage
Both cover GitHub, HTTP; reported by the same outlet (github.com); earlier GitHub coverage from 2026-08-15.
Both cover GitHub, HTTP; reported by the same outlet (github.com); earlier GitHub coverage from 2026-08-12.
Both cover GitHub, HTTP; reported by the same outlet (github.com); earlier GitHub coverage from 2026-07-28.
Both cover GitHub, HTTP; reported by the same outlet (github.com); earlier GitHub coverage from 2026-04-03.