From 3434ec36927a931d4699dc8659bbe9a7add7ce2c Mon Sep 17 00:00:00 2001 From: Adam Date: Sat, 17 Oct 2026 19:38:13 +0000 Subject: [PATCH] Record that the security pass fixes shipped Co-Authored-By: Claude Opus 5.5 --- plans/2026-10-16-security-preship-pass.md | 2 +- plans/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/plans/2026-10-16-security-preship-pass.md b/plans/2026-10-16-security-preship-pass.md index ad0cbddb2..ad11e6a0c 100644 --- a/plans/2026-10-16-security-preship-pass.md +++ b/plans/2026-10-16-security-preship-pass.md @@ -1,6 +1,6 @@ # Pre-ship security pass -**Status:** In progress. Audit finished 2026-10-16 against `main` at `df25e985`. The clear fixes are on branch `security/preship-pass`, not merged or deployed; the decisions for Adam are under [Needs Adam](#needs-adam). +**Status:** In progress. The fixes shipped on 2026-10-17: #148 merged as `f16e8a4`, migration `20261016120000` applied and all 14 Edge Functions redeployed on staging and production. The decisions under [Needs Adam](#needs-adam) are still open. The checklist follows the shape of a 25-item pre-ship security pass run by parallel subagents. The source post could not be fetched (x.com returned 402), so the items below are a standard pre-ship list adapted to DebateLab's stack: Supabase Postgres and Auth, Deno Edge Functions, a Vite client on Vercel, OpenRouter, Exa, Stripe, ElevenLabs and Google export. diff --git a/plans/README.md b/plans/README.md index 02f62da94..572ed2d43 100644 --- a/plans/README.md +++ b/plans/README.md @@ -6,7 +6,7 @@ Every plan lives in this folder and opens with a `**Status:**` line; a plan list ## In progress -- **Pre-ship security pass.** A 25-item audit of the database, Edge Functions, client and hosting, with fixes for the clear findings. Plan and report: [2026-10-16 security pre-ship pass](2026-10-16-security-preship-pass.md). +- **Pre-ship security pass.** A 25-item audit of the database, Edge Functions, client and hosting. The clear fixes shipped to production on 2026-10-17 (#148); the decisions for Adam remain. Plan and report: [2026-10-16 security pre-ship pass](2026-10-16-security-preship-pass.md). - **Staging that tracks main.** Audit of staging, the VPS sync timer, the seed, and what to delete. Plan: [2026-10-03 staging loop](2026-10-03-staging-loop.md). Previews come from #95 and the staging spec fix from #100. ## Backlog