Repository navigation

Close the remaining security gaps in apps, the dev server and the platform - #384

Merged

Brooooooklyn merged 51 commits into

security/1c-proxy-token-rotationfrom

security/1d-hardening

Oct 8, 2026

Merged

Close the remaining security gaps in apps, the dev server and the platform#384
Brooooooklyn merged 51 commits into
security/1c-proxy-token-rotationfrom
security/1d-hardening

Commits on Oct 8, 2026
- Answer prerender path discovery only inside the build-time runner
  
  Brooooooklyn
  and
  claude
  committed
  50b6cfd
- Resolve named page actions from own function properties only
  
  Brooooooklyn
  and
  claude
  committed
  73b0dc1
- Keep catch-all redirect destinations on the same site
  
  Brooooooklyn
  and
  claude
  committed
  d2278f4
- Send a generic message for unexpected deferred prop errors in production
  
  Brooooooklyn
  and
  claude
  committed
  5970251
- Ignore the session cookie on cross-origin unsafe requests and WebSocket upgrades
  
  Brooooooklyn
  and
  claude
  committed
  99db212
- Rate-limit auth endpoints on deployed Cloudflare apps
  
  Brooooooklyn
  and
  claude
  committed
  9229a39
- Document that a WebSocket's user is fixed for the connection
  
  Brooooooklyn
  and
  claude
  committed
  4ddf5d0
- Keep router.visit() page loads on the current origin
  
  Brooooooklyn
  and
  claude
  committed
  f471caf
- Reject route params that would change the request path
  
  Brooooooklyn
  and
  claude
  committed
  ac5a9df
- Send a fixed message for internal void/live errors
  
  Brooooooklyn
  and
  claude
  committed
  6a78178
- Explain that void/live topics are open until onSubscribe checks them
  
  Brooooooklyn
  and
  claude
  committed
  8c7ae4c
- Fail basicAuth closed when the password resolves to an empty value
  
  Brooooooklyn
  and
  claude
  committed
  43ac447
- Keep database URLs out of the project directory for db studio and db push
  
  Brooooooklyn
  and
  claude
  committed
  8e300c4
- Drop terminal control sequences from app logs printed by void logs
  
  Brooooooklyn
  and
  claude
  committed
  705c2d7
- Send Analog dev trigger proxy requests to the bound dev server, not the request Host
  
  Brooooooklyn
  and
  claude
  committed
  728ef20
- Refuse prerender paths that resolve outside the output directory
  
  Brooooooklyn
  and
  claude
  committed
  8a63850
- Run the Svelte island style loader only during builds
  
  Brooooooklyn
  and
  claude
  committed
  26ba561
- Show Hono cache() on a public route instead of as global middleware
  
  Brooooooklyn
  and
  claude
  committed
  1070496
- Pick upload keys on the server and serve stored files as downloads in docs examples
  
  Brooooooklyn
  and
  claude
  committed
  8bc5fe0
- Key hosted ISR entries on allowlisted query params for direct requests
  
  Brooooooklyn
  and
  claude
  committed
  85caa88
- Never store ISR renders made with query params outside the allowlist
  
  Brooooooklyn
  and
  claude
  committed
  34c005e
- Scope the hashed-asset edge cache key to the project
  
  Brooooooklyn
  and
  claude
  committed
  31faea6
- Keep AI gateway metadata and logging under platform control
  
  Brooooooklyn
  and
  claude
  committed
  08b1c1b
- Count only platform-signed AI Gateway rows toward project AI usage
  
  Brooooooklyn
  and
  claude
  committed
  b65253f
- Reserve certificate-authority validation mailbox names for new projects
  
  Brooooooklyn
  and
  claude
  committed
  b5ba63a
- Keep project logs from before the project was created out of its log view
  
  Brooooooklyn
  and
  claude
  committed
  72d15d2
- Require a Confirm button POST to grant email recipient consent
  
  Brooooooklyn
  and
  claude
  committed
  9d3e3ab
- Refuse framing of platform API and dashboard HTML pages
  
  Brooooooklyn
  and
  claude
  committed
  748d684
- Check useForm() route params when the form is submitted
  
  Brooooooklyn
  and
  claude
  committed
  81153ff
- Reset terminal styles after app log text that keeps colors
  
  Brooooooklyn
  and
  claude
  committed
  f52214e
- Remove database URLs that older CLI versions left in .void
  
  Brooooooklyn
  and
  claude
  committed
  848db1a
- Deploy the email gateway before the API
  
  Brooooooklyn
  and
  claude
  committed
  efd0d75
- Verify proxy credentials before reading the request body
  
  Brooooooklyn
  and
  claude
  committed
  f44139f
- Refuse email-only sign-in and linking for administrator accounts
  
  Brooooooklyn
  and
  claude
  committed
  07ab362
- Pause cron jobs and queue relays while an administrator suspends a project owner
  
  Brooooooklyn
  and
  claude
  committed
  16f8a88
- Limit platform deploys to 100 distinct cron expressions per project
  
  Brooooooklyn
  and
  claude
  committed
  a0442ea
- Explain cookie sharing on platform application domains
  
  Brooooooklyn
  and
  claude
  committed
  c4d127e
- Stop the dev server from serving the dev-trigger token
  
  Brooooooklyn
  and
  claude
  committed
  ad856ad
- Neutralize C1 terminal controls in human operator CLI output
  
  Brooooooklyn
  and
  claude
  committed
  1499350
- Stop the dev server from serving Astro's background dev log
  
  Brooooooklyn
  and
  claude
  committed
  1c7e720
- Tag provider-native AI calls with the signed usage tag and drop caller gateway headers
  
  Brooooooklyn
  and
  claude
  committed
  dfecdb3
- Keep invocations that started before the project was created out of its log view
  
  Brooooooklyn
  and
  claude
  committed
  4dc1b60
- Roll the email gateway back after the API in hosted rollback-all
  
  Brooooooklyn
  and
  claude
  committed
  1a70644
- Limit platform deploys to 1000 cron schedules per project
  
  Brooooooklyn
  and
  claude
  committed
  4c6cf8c
- Keep provider-native AI calls out of platform AI usage
  
  Brooooooklyn
  and
  claude
  committed
  fa78dae
- Stop the dev server from serving database URLs left in .void
  
  Brooooooklyn
  and
  claude
  committed
  cf9e4b9
- Say that a CNAME alone proves custom-domain ownership
  
  Brooooooklyn
  and
  claude
  committed
  551db5b
- Keep cache and retry gateway headers on provider-native AI calls
  
  Brooooooklyn
  and
  claude
  committed
  bc0a840
- Remove whole escape sequences from app logs printed by void logs
  
  Brooooooklyn
  and
  claude
  committed
  81b7e84
- Show the real void/live error message in dev
  
  Brooooooklyn
  and
  claude
  committed
  ef332ad
- Explain auth rate limits behind a proxy and in end-to-end tests
  
  Brooooooklyn
  and
  claude
  committed
  6294a67

Commits

Commits on Oct 8, 2026