staging → main: update-posting fix, performance pass, security hardening - #241

Merged

holkexyz merged 45 commits into

mainfrom

Aug 12, 2026

Commits on Jul 2, 2026

docs(review): full-codebase review findings + refactor plan

holkexyz
and
claude
committed
267588f
fix(security): harden SSRF filter and PDS proxy redirects/limits

holkexyz
and
claude
committed
129346f
fix(security): add per-target unlock throttle and stop feedback email relay

holkexyz
and
claude
committed
f548fd4
fix(next): unblock /embed framing, server-redirect root, cache OG metadata, tighten robots

holkexyz
and
claude
committed
ff145cd
perf(bundle): lazy-load TipTap editor and contributor board; memoize activity rows

holkexyz
and
claude
committed
4e1e7ca
perf(render): memoize explore/endorsement rows; fix nested main landmarks; dedupe truncateDid

holkexyz
and
claude
committed
71c7242
perf(navbar): split context into values/setters; mark page title as h1

holkexyz
and
claude
committed
dd99a94
fix(hooks): abort stale loadMore, dedupe paginated activities, retry session on HTTP error

holkexyz
and
claude
committed
d602bae
perf(hooks): batch project-item fetch via indexer; guard breakpoint resize storm

holkexyz
and
claude
committed
694fd5b
style(tokens): replace raw rgba with theme-aware tokens; add invariant scrim tokens

holkexyz
and
claude
committed
a84f80c
chore(cleanup): remove dead exports; dedupe truncateDid in workspace

holkexyz
and
claude
committed
1c42a4b
test(security): cover password-reset, clone-blob SSRF, members escalation, upload-blob limits

holkexyz
and
claude
committed
6dd73dd

Commits on Jul 12, 2026

docs(quality): perf/code-quality pass 2026-07-12 — prompt, verified findings, track plan

holkexyz
and
claude
committed
9aaada4
docs(quality): round-1 plan review decisions; corrected ownership + phase 0/1.5

holkexyz
and
claude
committed
89c656a
feat(lib): add postIndexer and deriveIdentity shared helpers

holkexyz
and
claude
committed
d6d4b1c

Commits on Jul 13, 2026

Commits on Jul 30, 2026

auth: support Vercel preview origins

Kzoeps
and
codex
committed
e1d0668
ci: run production build in pull requests

Kzoeps
and
codex
committed
2848864
auth: share loopback host validation

Kzoeps
and
codex
committed
2760a15
Merge pull request #239 from hypercerts-org/auth/vercel-preview-origins
Kzoeps
authored
2adc79f
ci: generate ephemeral cookie secret for build
Kzoeps
committed
205a0eb
Merge pull request #240 from hypercerts-org/ci/run-production-build
Kzoeps
authored
282f3a2

Commits on Aug 12, 2026

fix(xrpc): allowlist context.attachment so posting an update works

holkexyz
and
claude
committed
6c9b282