TheUnboundDeveloper/AM-Reaper v2.5.7-GT-BE98

Reaper v2.5.7 — GT-BE98

on GitHub

v2.5.7 — a round of quiet security hardening from the audit sweep

Built on RT-BE96U and verified in the image. A focused batch that closes the remaining low-severity findings from the 2026-07-31 security audit; no user-visible behaviour change beyond the password-change form. Not yet cut as a public CI release. The audit remainder now stands at zero Critical and zero High.

• Hardened: five low-severity audit findings closed; the rest verified already-fixed or deliberate. A three-byte over-read in the file-upload boundary scanner is now bounds-checked. The Gatekeeper "grandfather the currently-connected devices" step now refuses to overwrite its authorised-device list if that list is ever too large to load into its buffer — rather than silently dropping the devices it couldn't read — and logs it instead. The AI-Advisor USB-key session file now strips stray line breaks out of a volume name before writing it. The USB-eject helper now accepts only a numeric port or "all". And the password-change request now travels as a POST body instead of defaulting to a URL query, so a changed password no longer lands in browser history, the server access log, or a Referer header. A re-verification pass over the whole audit remainder found several other items were already fixed in earlier releases, and left two open on purpose — most notably the access-restriction rule, which fails open when it has no valid rules because failing closed would lock the administrator out of the router.

Images & checksums (GT-BE98)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Verify a download against the attached SHA256SUMS-GT-BE98-Reaper_v2.5.7.txt.

Corresponding source & reproducibility

The GT-BE98 image for v2.5.7 is built from this repository at tag v2.5.7-GT-BE98: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/ (0001-0473)
• Provenance record: provenance/manifest.json
• Source tree hash (release/src/router): dd0c73eaef96b0674f46ba2180416fb3d454fba5 -- reproduce by git am --keep-cr of the patches onto the base, then git rev-parse HEAD:release/src/router.
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v2.5.7-GT-BE98 (patches + docs).