---
title: "Éclair 1.10.3: first security audit, 15 flaws fixed"
description: "Éclair 1.10.3 fixes the 15 flaws and 8 leads found by a full code audit: the method, the figures, what changes for you, and the PDF report."
url: "https://eclaircms.org/blog/eclair-1-10-3-security-audit"
lang: "en"
author: "Thierry Gustin"
published: "2026-11-03"
updated: "2026-11-10"
---

# Éclair 1.10.3: first security audit, 15 flaws fixed

> **Key takeaways** — Released on November 3, 2026, Éclair 1.10.3 is a security release. A full audit of the 1.10.2 code, run with Cloudflare’s security-audit method and 86 agents, confirmed 15 flaws: 3 medium, 12 low, none critical or high. All of them are fixed, along with 8 leads tied to the server or the browser. Automated checks go from 620 to 918. The full report, in English, can be downloaded as a PDF.

Éclair 1.10.3, released on November 3, 2026, fixes everything the first full security audit of Éclair’s code found: 15 confirmed flaws, 3 of them medium, none critical or high, plus 8 leads that depended on the server or the browser. Everything is fixed in the code. If your site runs 1.10, the update takes one click.

## What’s new in Éclair 1.10.3?

| Item | What to remember |
| --- | --- |
| Audit no. 1 | All of the 1.10.2 code reviewed by 86 agents, 50 areas covered |
| Confirmed flaws | 15: 3 medium, 12 low, 0 high, 0 critical |
| Leads needing validation | 8, tied to hosting or the browser, all closed in the code |
| Hardening | More than 50 of the audit’s recommendations applied |
| Automated checks | From 620 to 918, with a real update from 1.10.2 to 1.10.3 tested from GitHub |
| Archive | 619 KB (602 KB in 1.10.2) |
| Your public site | Unchanged: published pages stay identical, byte for byte |

These fixes come right after 1.10.2, released the day before, which I cover further down. The full audit report is online: it is in English, in PDF format, and runs to 18 pages.

## How was the audit carried out?

The audit follows Cloudflare’s public [*security-audit* method](https://github.com/cloudflare/security-audit-skill). It splits the software into areas to cover, then sends out waves of independent “hunter” agents. Every lead they find is then checked again by other agents that did not see it start, before it goes into the report. A lead ends up confirmed, needing validation, or rejected.

For 1.10.2, that gives:

- **86 agents**: 4 for reconnaissance, 22 hunters in 5 waves, 6 coverage critics and 54 verifiers;
- **50 areas covered**, and a final review that found no gap;
- **24 final records**: 15 confirmed flaws, 8 leads needing validation, 1 rejected lead.

All of it was done by reading the code and testing it locally, in a sandbox isolated by the operating system: no network access, dummy data and dummy keys, and no real site probed. Your site was never used as a test bed.

The audit concludes that the code is defensive overall: cryptography, update signing, content cleaning, sessions and form protection hold on most of their paths.

## Which flaws were fixed?

First, the three medium flaws:

- **The log-out buttons** “Log out my other devices” and “Log everyone out” unintentionally renewed the password confirmation. They no longer do.
- **Reserved redirects**: an editor can no longer redirect `/.well-known/` addresses or Éclair’s internal `/_eclair/` addresses. Existing ones are disabled, and you can delete them. An administrator can still redirect other `/.well-known/` addresses, such as `change-password`.
- **A cap on content**: a site holds at most 3,000 contents, the AI stops creating drafts at 500, and the search index keeps only published text, up to 16 MB. Your existing content always stays editable.

The 12 low flaws mostly concern derived copies and limits that did not keep their promise. A deleted account now disappears from the page cache. A backup never contains the vault (API keys, Google Drive connection), even with a badly written setting. The sending limits of the contact form and the MCP connector are now strict. Finally, update announcements carry a signed serial number and expiry date.

The 8 leads depended on a fact that cannot be observed offline, such as how a host behaves. They are all closed in the code anyway. The report gives no exploitation detail: for each item, it says what was wrong and how it was fixed.

## What changes in your admin?

Most fixes are invisible. A few change how you work:

- **🔒 Two-factor authentication**: to switch phones, disable 2FA with your current password, then enable it again. This is done in **My profile**.
- **🔑 Usual devices**: after the update, each device becomes “usual” again at its next successful login.
- **☁️ Google Drive**: a connection made before 1.10.3 is flagged. Disconnect it, then reconnect it, so Éclair records who set it up.
- **🤖 MCP connector**: an app other than Claude or ChatGPT always asks for your password, and the **Allow** button turns on after a short moment, once you move the mouse or touch the screen.
- **✍️ Editor**: the local copy of your unsaved work belongs to the signed-in account and is erased at logout.
- **💾 Contact form**: once the 100 messages per day for the whole site are reached, it refuses everyone for 24 hours.

If you use Nginx, update your rules from the guide: `media/` no longer serves `.js` or `.mjs` files.

## What did 1.10.2, released the day before, fix?

1.10.2, released on November 2, 2026, solved two concrete problems.

1. **o2switch’s antivirus** blocked the archive in the file manager. It was a false positive on the one-click update code. File operations now live in a small separate class, and a test checks that no shipped file repeats the suspicious sequence. Your site sees no difference.
2. **Google Drive opens to every site.** The connection relied on Google credentials built into the archive, which were never configured: the card stayed closed. Each site can now use its own Google app. **Security › Google Drive backups** guides you step by step (free, about ten minutes, once), then you paste the client ID and the client secret. The secret is encrypted on your server.

## How do you upgrade to Éclair 1.10.3?

From 1.10.0 or later, the update is done in the admin:

1. If several accounts work on your site, **save any open edits**: unsaved copies from 1.10.2 are not kept.
2. Make a backup: **Download a backup**, or a Google Drive backup.
3. Open **Admin › Updates**, tick the backup box, then click **Update**.

The update installs the latest available version, which includes these fixes. On 1.9 or earlier? Go through FTP one last time, with the archive from the [Download](https://eclaircms.org/en/download) page and the [update guide](https://eclaircms.org/en/documentation/updates).

## Where can you read the full audit report?

The full report is in English, in PDF format, over 18 pages. It describes the method, the sandbox, each flaw with its fix, and the limits of the exercise. It also covers the second audit, run on 1.10.3, and the 1.10.4 release that followed: [read the article on Éclair 1.10.4](https://eclaircms.org/blog/eclair-1-10-4-second-security-audit).

[Download the audit report (PDF in English, 18 pages)](https://eclaircms.org/assets/site/eclair-cms-security-report-2026-11.pdf)

The report is honest about its limits: it does not claim Éclair is free of defects. The protections are also explained in [Éclair’s security](https://eclaircms.org/en/documentation/security), and every version is in the [changelog](https://eclaircms.org/en/changelog).

## Frequently asked questions about Éclair 1.10.3

### Was my site attacked?

The audit is not about your site: it examined Éclair’s source code, in a sandbox, with dummy data, and no real site was probed. The flaws it found are fixed in 1.10.3.

### Should I install Éclair 1.10.3 right away?

Yes, it is a security release. Make a backup, then open Admin › Updates: the latest version includes these fixes. If several accounts work on your site, save any open edits first.

### Where is the audit report, and what language is it in?

The report is in English, an 18-page PDF. You can download it at [/assets/site/eclair-cms-security-report-2026-11.pdf](https://eclaircms.org/assets/site/eclair-cms-security-report-2026-11.pdf). It contains no exploitation detail.

### What do I need to do for Google Drive?

If you connected it before 1.10.3, the Security page flags it: disconnect it, then reconnect it. Éclair then records who set up the connection, and removes it if that account is deleted or loses its administrator role.

### How much does this update cost?

Nothing: Éclair stays free, under the AGPL-3.0 open-source license, and the update does not use AI. The archive weighs 619 KB, and your public site stays identical.

[Download Éclair 2.3.0](https://eclaircms.org/en/download)

— Thierry Gustin, Créateur d’Éclair CMS, consultant SEO et formateur IA · November 10, 2026