Skip to content

feat(security): enhance security features and logging in Dio#2525

Open
Sylvester-git wants to merge 1 commit into
cfug:mainfrom
Sylvester-git:ebinehita
Open

feat(security): enhance security features and logging in Dio#2525
Sylvester-git wants to merge 1 commit into
cfug:mainfrom
Sylvester-git:ebinehita

Conversation

@Sylvester-git
Copy link
Copy Markdown

  • Add CertificatePinner for fingerprint-based certificate pinning.
  • Implement maxResponseSize to prevent memory exhaustion from large responses.
  • Warn developers about missing timeouts in requests.
  • Improve LogInterceptor to redact sensitive headers in logs.
  • Update SECURITY.md with secure usage guidelines.

New Pull Request Checklist

  • I have read the Documentation
  • I have searched for a similar pull request in the project and found none
  • I have updated this branch with the latest main branch to avoid conflicts (via merge from master or rebase)
  • I have added the required tests to prove the fix/feature I'm adding
  • I have updated the documentation (if necessary)
  • I have run the tests without failures
  • I have updated the CHANGELOG.md in the corresponding package

Additional context and info (if any)

- Add CertificatePinner for fingerprint-based certificate pinning.
- Implement maxResponseSize to prevent memory exhaustion from large responses.
- Warn developers about missing timeouts in requests.
- Improve LogInterceptor to redact sensitive headers in logs.
- Update SECURITY.md with secure usage guidelines.
@Sylvester-git Sylvester-git requested a review from a team as a code owner May 24, 2026 12:31
Copy link
Copy Markdown
Member

@AlexV525 AlexV525 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the purposal. But first, what is the motivation of these changes?

I've also have a couple of questions:

  1. What cannot be done with the current dio?
  2. The new SECURITY.md seems not only covering security concerns, and doesn't look like a standard security guide for the repo.
  3. Why the request touches .gitignore?

We generally prefer precise, motivated, well-cared requests. Please reconsider if this is good to go. :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants