Commit history for src/server/security
- Security: migration 0021 (display name/website cleanup, org settings, invitations, stale follow purge); attachment quotas attributed to guest uploaders plus orphan sweeper and asset nosniff/overwrite cleanup (AZ-A14); advisory open counts and collaborator roster only for managers, collaborators need repo read (AZ-A15); page clamps and browse limits (AZ-A17); profile feed hides deleted private repos, inbox tolerates malformed URLs (AZ-A18); revoked secrets no longer allowlisted, review comment edit/delete UI (AZ-A19)286f978⌁taigrr committed
- Merge roadmap/notify7417d6f⌁taigrr committed
- Merge roadmap/platformfixa662571⌁taigrr committed
- Scope commit signature lookups to the repository, 404 on missing alerts, gate draft release assets, refuse private webhook targets, stop dequeued merges, report workflow compile failures, support git protocol v2 with the default branch as HEAD, and post every password form.20aff54⌁taigrr committed
- Harden git, LFS, CI, Pages, auth and pull requests against the security review findings, and add a token API for the gfd CLI.4e8720e⌁taigrr committed
7f485b4⌁
- Merge roadmap/security: signatures, secret scanning, code scanning, advisories, dependency graphbad844a⌁taigrr committed