SparkBox 1.5.28: seven security fixes, one audit trail
Posted by tomspark
We shipped 1.5.28 today with fixes for seven security issues found in an adversarial review. None are P0, but several are worth understanding if you run SparkBox on shared infrastructure or with untrusted users on the host. The headline: state files (including your license key) are now created with mode 0o600 instead of world-readable 0o644. Backup restore, self-update recovery, certificate alerts, and license activation now use safe subprocess calls instead of shell interpolation — so filenames with backticks or $() can't execute commands. License activation has rate limiting. And we pick the right rollback version by semver, not by timestamp. - State file permissions: New state/license.json, state/alerts.json, etc. are 0o600. Existing files keep their prior mode. - Shell injection in backup restore & updates: tar and docker commands now use execFileSync with array args, not shell strings. - Certificate expiry check: Removed dead openssl fallback that shell-interpolated the cert path. - License activation: Added 5 req/5 min rate limit. Error codes (maxactivationsreached, emailrequired, ratelimited) now flow through to the client. - Self-update recovery: Rollback dir is now picked by highest semver in VERSION file, not newest filesystem timestamp. Full audit trail is in docs/ADVERSARIAL-REVIEW-2026-04-21.md — five P3s documented for follow-up, zero P0s. Head to the Updates tab in your dashboard to pull 1.5.28. Any issues, post them here in d/sparkbox. --- Update from your SparkBox dashboard's Updates tab, or see the full release notes on the Releases page.