Repository navigation

Close small security gaps in dev restart, deploy upload, project tokens, and CI ownership - #377

Merged

Brooooooklyn merged 8 commits into

mainfrom

security/1a-quick-fixes

Oct 8, 2026

Merged

Close small security gaps in dev restart, deploy upload, project tokens, and CI ownership#377
Brooooooklyn merged 8 commits into
mainfrom
security/1a-quick-fixes

Commits on Oct 8, 2026
- Restrict the dev restart page to same-origin navigation and callers
  
  Brooooooklyn
  and
  claude
  authored
  f4d2bfe
- Validate Worker module names before the Cloudflare upload
  
  Brooooooklyn
  and
  claude
  authored
  3b2c227
- Require a generated project id before verifying project tokens
  
  Brooooooklyn
  and
  claude
  authored
  8ce8a26
- Add CODEOWNERS for CI, scripts, and dependency manifests
  
  Brooooooklyn
  and
  claude
  authored
  656ee95
- Use generated-shape ids for seeded local projects
  
  Brooooooklyn
  and
  claude
  authored
  2175cce
- Require a per-server token to restart the dev server
  
  Brooooooklyn
  and
  claude
  authored
  ff04643
- Remove old demo projects before reseeding local data
  
  Brooooooklyn
  and
  claude
  authored
  fd5a6bf
- Require a Void team review for script folders at any depth
  
  Brooooooklyn
  and
  claude
  authored
  db153ea