Commit history for src/server
- Harden CI quota, preview trust, action archives, cache quota and log masking (CI-P1..P11)c5d0250⌁taigrr committed
- Gate remaining admin REST writes on archived repos, hide owner runners from repo admins on the web, and make the last-owner guard atomic.61438e0⌁taigrr committed
- Refuse the unsubscribe key fallback without SECRETS_KEY (DEPLOY-P10) and update the self-host guide for bootstrap-token admin setup.eed5d63⌁taigrr committed
- Harden production deploys: config split with boot assertions, admin bootstrap, security headers, error maskinga76edca⌁taigrr committed
- Fix pre-deploy authz findings: transfers need admin on both accounts, archived and scope gates on admin REST writes, inbox and dashboard filtered by current access, revocation purges assignments and notifications, missing rate limits.ed881e4⌁taigrr committed
- Enforce the spending limit across meters inside the reservation transaction so concurrent holds cannot jointly overshoot it, and let admin-set plans stick until an admin hands the account back to Stripe billing.192c134⌁taigrr committed
- Harden the git proxy and bridges before deploy: trust only ok'd refs, restrict v2 commands, fail closed on unloadable thin-pack bases, rate-limit before auth, shorten public raw caching, and charge bridged bytes to the head owner (CI-P6, GIT-P4..P7, P9..P12, GIT-14/PR-12).23526ca⌁taigrr committed
- Close pre-deploy auth gaps: deploy tokens die with repo transfers, password resets and lost admin; token revocation cascades through every descendant; agent tokens minted over REST stay within the caller's grant; TOTP failures lock out persistently; login, email removal, passkey counters, signing-key lookup and sign-out-everywhere hardened.c9c6455⌁taigrr committed
- Move ipBucket into a pure module so its tests cannot be broken by other suites mocking ./limits.643bd46⌁taigrr committed
- Close billing abuse gaps before launch: stop AI calls once tokens are spent, keep org billing owner-only (admins view-only), key rate limits on the IPv6 /64, withhold compute and AI from unverified free accounts and their orgs, and rate-limit scratch git mode and GitHub sign-ups.9058348⌁taigrr committed
- Generate deterministic lava-lamp avatars client-side in place of initials, static by default and drifting on hover, show owner avatars in repo lists, and keep unfinished repos and admin-only private repos out of explore.8e9a6c6⌁taigrr committed
- Merge roadmap/upsellefa5b44⌁taigrr committed
- Merge roadmap/pricing-posthog186686d⌁taigrr committed
- Merge roadmap/stripe-billinga22ce03⌁taigrr committed
- abuse and metering486d635⌁taigrr committed
- Merge roadmap/mergefix-proposals1e3de79⌁taigrr committed
a360a78⌁
- Open a paginated day breakdown under the contribution graph when a day is clicked, and let users show their private contributions to visitors as anonymous counts or keep them hidden.aa762f9⌁taigrr committed
- Sweep imports and forks whose provisioning Workflow was lost: refresh them once, then mark them failed if still pending.e543b2d⌁taigrr committed
- Show commits as their author's account wherever the commit email is one of that account's verified addresses, instead of the raw git name with a mismatched avatar.4e89c38⌁taigrr committed
- Serve GitHub-style .diff and .patch suffixes on commit, pull request and compare URLs so changes can be piped into git apply and git am.7cbad77⌁taigrr committed
- Gate idle self-hosted runner long-polls on per-scope job doorbells so they stop scanning queued jobs in D1 every two seconds until a job is actually queued for their repo or owner.91e0d88⌁taigrr committed
- Credit contributions by verified commit email from a per-repo commit index, let users keep several verified addresses, make mentions survive renames, add repo Insights, and move per-request counters, unread counts, webhook logs and git/download metering off D1 into Durable Objects so write load scales with entities instead of traffic.9517d99⌁taigrr committed
- Cap every non-push-token credential at read on unclaimed scratch repos, site admins and deploy tokens included, so LFS, contents API and web writes follow the git proxy guard459f46f⌁taigrr committed
- Merge roadmap/tests-securitydd86194⌁taigrr committed
- Skip dependency scans whose commit is no longer the default-branch head, so an out-of-order scan can't wipe newer results.056aadd⌁taigrr committed
- Allow loopback webhook sinks and disable rate limits for local e2e runs, only on a loopback forge with the dev flags set.55d6661⌁taigrr committed
- Accept pushes to scratch repositories only with their scratch push token, and return 422 for case-insensitive duplicate labels.f760be0⌁taigrr committed
- Security: tighten the POST-A/B fixes after re-review (entity-decoded camo decisions, own-host images load directly, own-host checks on verify and redirects, SVG badges kept, targeted 5xx masking, same-site user-content as a warning, per-isolate walk dedupe, plan gate on preview tickets).d958823⌁taigrr committed