Commit history
- Harden the git proxy and bridges before deploy: trust only ok'd refs, restrict v2 commands, fail closed on unloadable thin-pack bases, rate-limit before auth, shorten public raw caching, and charge bridged bytes to the head owner (CI-P6, GIT-P4..P7, P9..P12, GIT-14/PR-12).23526ca⌁taigrr committed
- Close pre-deploy auth gaps: deploy tokens die with repo transfers, password resets and lost admin; token revocation cascades through every descendant; agent tokens minted over REST stay within the caller's grant; TOTP failures lock out persistently; login, email removal, passkey counters, signing-key lookup and sign-out-everywhere hardened.c9c6455⌁taigrr committed
- Move ipBucket into a pure module so its tests cannot be broken by other suites mocking ./limits.643bd46⌁taigrr committed
- Close billing abuse gaps before launch: stop AI calls once tokens are spent, keep org billing owner-only (admins view-only), key rate limits on the IPv6 /64, withhold compute and AI from unverified free accounts and their orgs, and rate-limit scratch git mode and GitHub sign-ups.9058348⌁taigrr committed
- Add TanStack Start's CSRF middleware for server functions so GET server functions are same-origin only too.3b3fccd⌁taigrr committed
6472361⌁
- Generate deterministic lava-lamp avatars client-side in place of initials, static by default and drifting on hover, show owner avatars in repo lists, and keep unfinished repos and admin-only private repos out of explore.8e9a6c6⌁taigrr committed
- Merge roadmap/upsellefa5b44⌁taigrr committed
- Merge roadmap/posthog-email10d3a06⌁taigrr committed
- Replace the cloud logo with a salamander whose tapered tail forks into a git branch, so the mark no longer resembles Cloudflare's while keeping the orange.262a313⌁taigrr committed
- Merge roadmap/pricing-posthog186686d⌁taigrr committed
- Merge roadmap/stripe-billinga22ce03⌁taigrr committed
- abuse and metering486d635⌁taigrr committed
- Merge roadmap/mergefix-proposals1e3de79⌁taigrr committed
- Show who reacted when hovering a reaction, loading at most five names on demand and summarizing the rest as a count so huge reaction totals stay cheap.486e8a2⌁taigrr committed
- Float the reaction picker above its button instead of inserting it into the bar, so opening it no longer shifts the comment layout.77e5dbe⌁taigrr committed
- Open a paginated day breakdown under the contribution graph when a day is clicked, and let users show their private contributions to visitors as anonymous counts or keep them hidden.aa762f9⌁taigrr committed
- Sweep imports and forks whose provisioning Workflow was lost: refresh them once, then mark them failed if still pending.e543b2d⌁taigrr committed
- Send signed-in users from the sign-in, sign-up, two-factor and forgot-password pages to the dashboard instead of showing forms that no longer apply.cab88e1⌁taigrr committed
- Show commits as their author's account wherever the commit email is one of that account's verified addresses, instead of the raw git name with a mismatched avatar.4e89c38⌁taigrr committed
- Serve GitHub-style .diff and .patch suffixes on commit, pull request and compare URLs so changes can be piped into git apply and git am.7cbad77⌁taigrr committed
- Gate idle self-hosted runner long-polls on per-scope job doorbells so they stop scanning queued jobs in D1 every two seconds until a job is actually queued for their repo or owner.91e0d88⌁taigrr committed
- Credit contributions by verified commit email from a per-repo commit index, let users keep several verified addresses, make mentions survive renames, add repo Insights, and move per-request counters, unread counts, webhook logs and git/download metering off D1 into Durable Objects so write load scales with entities instead of traffic.9517d99⌁taigrr committed
- Cap every non-push-token credential at read on unclaimed scratch repos, site admins and deploy tokens included, so LFS, contents API and web writes follow the git proxy guard459f46f⌁taigrr committed
- Merge roadmap/tests-securitydd86194⌁taigrr committed
- Skip dependency scans whose commit is no longer the default-branch head, so an out-of-order scan can't wipe newer results.056aadd⌁taigrr committed
- Drain small unread request bodies instead of cancelling them; cancelling still broke reused dev connections.90db13c⌁taigrr committed
- Drain unread request bodies once a custom route has answered, so early rejections don't poison keep-alive connections.a10c5a9⌁taigrr committed