jcoffey-dev 519bf85303 Security, second batch: pack and icon markup checked by parsing HTML; check runs security rules on redirect pages and flags script links; safe importer slugs and writes; Markdown attributes limited to id and class; plain form subjects; recipient allowlist; IPv6 rate limits per /64, stored submissions capped; bounded, rate-limited search; listener timeouts; bookkeeping files never served; collision-proof discovered ids and one discovery at a time; CI secrets kept from pushable branches; SECURITY.md and docs/security.md

2026-10-10 20:47:41 -07:00

..

config.go

Security, second batch: pack and icon markup checked by parsing HTML; check runs security rules on redirect pages and flags script links; safe importer slugs and writes; Markdown attributes limited to id and class; plain form subjects; recipient allowlist; IPv6 rate limits per /64, stored submissions capped; bounded, rate-limited search; listener timeouts; bookkeeping files never served; collision-proof discovered ids and one discovery at a time; CI secrets kept from pushable branches; SECURITY.md and docs/security.md

2026-10-10 20:47:41 -07:00

endpoint_test.go

Security, second batch: pack and icon markup checked by parsing HTML; check runs security rules on redirect pages and flags script links; safe importer slugs and writes; Markdown attributes limited to id and class; plain form subjects; recipient allowlist; IPv6 rate limits per /64, stored submissions capped; bounded, rate-limited search; listener timeouts; bookkeeping files never served; collision-proof discovered ids and one discovery at a time; CI secrets kept from pushable branches; SECURITY.md and docs/security.md

2026-10-10 20:47:41 -07:00

mail.go

Rename to HotDog CMS: hotdog-cms command and module, HOTDOG_ settings, hotdog- site hooks, brand assets, branded editor

2026-10-10 15:57:07 -07:00

ratelimit.go

Forms, the endpoint, and search from it

2026-10-10 14:10:17 -07:00

search.go

Security, second batch: pack and icon markup checked by parsing HTML; check runs security rules on redirect pages and flags script links; safe importer slugs and writes; Markdown attributes limited to id and class; plain form subjects; recipient allowlist; IPv6 rate limits per /64, stored submissions capped; bounded, rate-limited search; listener timeouts; bookkeeping files never served; collision-proof discovered ids and one discovery at a time; CI secrets kept from pushable branches; SECURITY.md and docs/security.md

2026-10-10 20:47:41 -07:00

server.go

Security, second batch: pack and icon markup checked by parsing HTML; check runs security rules on redirect pages and flags script links; safe importer slugs and writes; Markdown attributes limited to id and class; plain form subjects; recipient allowlist; IPv6 rate limits per /64, stored submissions capped; bounded, rate-limited search; listener timeouts; bookkeeping files never served; collision-proof discovered ids and one discovery at a time; CI secrets kept from pushable branches; SECURITY.md and docs/security.md

2026-10-10 20:47:41 -07:00

store.go

Security, second batch: pack and icon markup checked by parsing HTML; check runs security rules on redirect pages and flags script links; safe importer slugs and writes; Markdown attributes limited to id and class; plain form subjects; recipient allowlist; IPv6 rate limits per /64, stored submissions capped; bounded, rate-limited search; listener timeouts; bookkeeping files never served; collision-proof discovered ids and one discovery at a time; CI secrets kept from pushable branches; SECURITY.md and docs/security.md

2026-10-10 20:47:41 -07:00

token.go

Forms, the endpoint, and search from it

2026-10-10 14:10:17 -07:00

turnstile.go

Forms, the endpoint, and search from it

2026-10-10 14:10:17 -07:00

viewer.go

E7: form builder with live preview, private submissions viewer on the endpoint, read in the editor

2026-10-10 18:29:52 -07:00