jcoffey-dev 519bf85303 Security, second batch: pack and icon markup checked by parsing HTML; check runs security rules on redirect pages and flags script links; safe importer slugs and writes; Markdown attributes limited to id and class; plain form subjects; recipient allowlist; IPv6 rate limits per /64, stored submissions capped; bounded, rate-limited search; listener timeouts; bookkeeping files never served; collision-proof discovered ids and one discovery at a time; CI secrets kept from pushable branches; SECURITY.md and docs/security.md

2026-10-10 20:47:41 -07:00

..

check_test.go

E6: search and social preview, a fix for every check finding, redirects table, moving pages with automatic redirects

2026-10-10 18:08:03 -07:00

check.go

E6: search and social preview, a fix for every check finding, redirects table, moving pages with automatic redirects

2026-10-10 18:08:03 -07:00

consent_test.go

E6: consent banner and consent-gated analytics wizard, privacy notice built from the site's settings

2026-10-10 18:19:31 -07:00

csp.go

E6: consent banner and consent-gated analytics wizard, privacy notice built from the site's settings

2026-10-10 18:19:31 -07:00

fixes.go

Security, second batch: pack and icon markup checked by parsing HTML; check runs security rules on redirect pages and flags script links; safe importer slugs and writes; Markdown attributes limited to id and class; plain form subjects; recipient allowlist; IPv6 rate limits per /64, stored submissions capped; bounded, rate-limited search; listener timeouts; bookkeeping files never served; collision-proof discovered ids and one discovery at a time; CI secrets kept from pushable branches; SECURITY.md and docs/security.md

2026-10-10 20:47:41 -07:00

pages.go

Security, second batch: pack and icon markup checked by parsing HTML; check runs security rules on redirect pages and flags script links; safe importer slugs and writes; Markdown attributes limited to id and class; plain form subjects; recipient allowlist; IPv6 rate limits per /64, stored submissions capped; bounded, rate-limited search; listener timeouts; bookkeeping files never served; collision-proof discovered ids and one discovery at a time; CI secrets kept from pushable branches; SECURITY.md and docs/security.md

2026-10-10 20:47:41 -07:00

rules.go

Security, second batch: pack and icon markup checked by parsing HTML; check runs security rules on redirect pages and flags script links; safe importer slugs and writes; Markdown attributes limited to id and class; plain form subjects; recipient allowlist; IPv6 rate limits per /64, stored submissions capped; bounded, rate-limited search; listener timeouts; bookkeeping files never served; collision-proof discovered ids and one discovery at a time; CI secrets kept from pushable branches; SECURITY.md and docs/security.md

2026-10-10 20:47:41 -07:00