Add HSTS, social image, touch icon, and structured data - #6
Conversation
From an audit of tinystudio.io (7 findings). Each item below was verified against the live host first rather than trusted from the report. - Strict-Transport-Security was genuinely absent; curl confirmed no such header on the live response. HTTPS already works on the apex, www, and app hosts, so a year-long max-age with includeSubDomains is safe. - og:image and twitter:image were missing entirely, so shared links rendered with no card. Added a 1200x630 image built from the site's own palette (#fbfaf5 paper, #161614 ink, #0c8b63 green) and its existing logo mark, with copy taken verbatim from the page's own description. No new claims. - apple-touch-icon was missing; added at 180x180 from the same mark. - No JSON-LD at all. Added a plain schema.org Organization carrying only the name, url, logo, and the description already in the head. Both new files are registered in PUBLIC_ASSET_PATHS. The worker serves assets through an explicit allowlist, so without that they would 404 and the social card would silently stay broken -- the exact failure this commit removes. Thin content on the home page (213 rendered words) is left alone: that is a copy decision, not a mechanical fix. Verified: npm run check passes.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
Warning Review limit reached
Next review available in: 19 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (2)
Comment |
The original og-image.png (PR #6) was built while the root page was the retired TinyStudio Agent Desk, so its copy advertised the legacy product — sharing the home page after the tag fix would render a card for the wrong offer. Rebuild it with the current site's palette (index.css cream/ink/ brass), the existing favicon.svg mark, and copy verbatim from the current home page headline and description. No new claims. scripts/generate-og-image.mjs renders the card in real Chromium at exactly 1200x630 and refuses to write unless the Google Fonts load, every element sits inside the canvas, and the pixels contain the cream background, ink text, and brass accents. The check-site.mjs social guard keeps all five pages pointed at this file with dimensions matching its PNG header.
) * seo: complete the social share image on home and every public page The leak audit this site sells flags a homepage whose served HTML cannot tell a social platform what to show when shared. The dogfood audit run 20260808T074205Z-msk2fl3n found exactly that on this site's own home page (finding d87d715be3d0, 'Social share image incomplete on home'): public/index.html served zero og:/twitter: tags even though public/og-image.png exists and is allow-listed in the worker. Add the complete Open Graph + Twitter Card set (og:title, og:description, og:type, og:url, og:image with width/height/alt, twitter:card summary_large_image, twitter:title/description/image) to the heads of all five public pages, mirroring each page's meta description and pointing og:image at the absolute https://tinystudio.io/og-image.png (1200x630, matching the PNG header). Add a source-string CI guard in scripts/check-site.mjs (social share tags section) so the fault cannot return: each page must carry each tag exactly once inside <head>, og:description must equal the page's meta description, og:image must be the absolute og-image.png URL, and the declared dimensions must match the actual PNG bytes. * seo: regenerate the social share image for the current offer The original og-image.png (PR #6) was built while the root page was the retired TinyStudio Agent Desk, so its copy advertised the legacy product — sharing the home page after the tag fix would render a card for the wrong offer. Rebuild it with the current site's palette (index.css cream/ink/ brass), the existing favicon.svg mark, and copy verbatim from the current home page headline and description. No new claims. scripts/generate-og-image.mjs renders the card in real Chromium at exactly 1200x630 and refuses to write unless the Google Fonts load, every element sits inside the canvas, and the pixels contain the cream background, ink text, and brass accents. The check-site.mjs social guard keeps all five pages pointed at this file with dimensions matching its PNG header. * ci: require the correct attribute per social tag (og:=property, twitter:=name)
1 participant
Audit of
tinystudio.ioreturned 7 findings. Every one was verified against the live host before changing anything — after finding two false positives on 0509, I no longer trust a report without checking.Confirmed real, and fixed
curl -Ishowed nostrict-transport-securityog:image/twitter:imageog:title,og:type,og:urlin the live headfavicon.svgpresentOrganizationaddedAbout the image
Built from the site's own palette (
#fbfaf5paper,#161614ink,#0c8b63green) and its existing logo mark, with copy lifted verbatim from the page's current description. It makes no claim the site doesn't already make.The trap worth noting
The worker serves assets through an explicit
PUBLIC_ASSET_PATHSallowlist. Both new images are registered there — without it they'd 404 and the social card would silently stay broken, which is precisely the bug this PR removes. Same shape as the font allowlist issue on inish.in earlier today.Left alone
Thin home content (213 rendered words) and the related AI-readiness finding are copy decisions, not mechanical fixes. Flagged, not guessed at.
npm run checkpasses.