In short

This site pins every CDN-hosted library (Font Awesome, Mermaid, Lunr, and others) with Subresource Integrity hashes, and a weekly cron job on the Hugo VM checks those hashes are still valid and auto-bumps minor/patch versions when a newer release is available. That job had been failing every single run for weeks, silently, and today’s investigation turned up two distinct bugs — one in operator infrastructure, one in mcp-hugo-server-go itself.

In short

Since August 20, 2026, our custom MCP connector (self-hosted, mcp.arleo.eu, OAuth 2.1 + PKCE + MCP-spec compliant) stopped working in ChatGPT, without a single line of code or configuration changing on the server side. The connector had worked without issue up until the day before.

In short

Claude.ai (Pro account), connected to the same self-hosted MCP server (mcp.arleo.eu), ran a complete audit of the 72 tools exposed at admin scope on version v1.9.2 — tool by tool, with a systematic justification for every verdict.

What Claude.ai says about the server overall

Before the tool-by-tool detail, the overall assessment as formulated by Claude.ai itself:

• Real write cycles hold up end to end: create → update → plan → apply → rollback → delete, on both simple pages AND bilingual bundles, with hashes returning exactly to their starting value on every rollback
• Security/concurrency guardrails (revision guards, asset_referenced, test_content blocking draft:false, the destructive quota) behave exactly as documented, including in deliberately provoked edge cases (chunk replay, an attempt to delete a referenced asset)
• The three investigation points left open in the previous audit (determinism, stale cache, metric clarification) are not only fixed but verified under real conditions, not just read off a changelog
• Final cleanup: the site returns bit-for-bit to its initial state (86 pages, 0 residue, health score 100)

But Claude.ai was also explicit about what its own audit method cannot cover — structural blind spots, not identified defects:

In short

Scope: defenses actually implemented in arleo.eu’s MCP server (mcp-hugo-server-go) against indirect prompt injection and tool poisoning, available since v1.9.3: systematic provenance tagging (content_provenance), a tool-registry fingerprint (tool_registry_digest), explicit untrusted-derivation self-declaration, a delete-confirmation gate, a documented threat model. Not covered: this isn’t an incident — this article documents a defense architecture, not an after-the-fact fix. What remains out of scope (client-side mitigation, semantic filtering deliberately rejected) is detailed further below.

In short

Two Internet scan bursts exposed a latent defect in the OpenResty/CrowdSec request path. The scanners did not overwhelm OpenResty by volume; the request rate was modest for nginx. They triggered a code path that attempted to load a custom Lua module that fresh OpenResty workers could not resolve.

This page publicly credits security researchers who reported a vulnerability on this site under responsible disclosure.

How to report

The full procedure (contact, PGP key, remediation timeline) lives in security.txt (RFC 9116) — that’s the single source of truth. Please report any vulnerability responsibly, without exploiting it beyond what is strictly necessary to demonstrate it. Reports can remain anonymous on request.

Researchers

No report has been credited here yet. If you found a vulnerability that was fixed on this site and would like to be listed, please let us know when you report it.