4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
implementer	a2fa1dee32	chore: bootstrap pnpm workspace and package manifests ... E00-S01-T01: create workspace/package manifests - root package.json pins packageManager pnpm@11.23.0 - pnpm-workspace.yaml separates apps/*, packages/*, extensions/* entries - skeleton manifests for apps/server, packages/core, extensions/example - committed frozen lockfile generated by pnpm 11.23.0 - minimal CI: pnpm install --frozen-lockfile + workspace verification	2026-08-27 23:07:58 +00:00
implementer	e186faeb44	Add root .gitignore for local env files and node_modules ... Ignores .env, .env.*, and node_modules/ at any depth so local secrets and dependency directories can never be committed accidentally. Single-file hygiene change; no tracked files affected. Closes #19.	2026-08-26 19:34:37 +00:00
implementer	32c81d8b91	test: add 3xx-redirect failure and no-credential-header/URL checks ... Extends the newsletter suite with two boundary cases: redirects (301/302/307/ 308) must be treated as failures with the user-safe error, and the POST must carry no credential of any kind — no api-key/auth-token/cookie headers, and no token/secret in the body or URL.	2026-08-26 11:31:54 +00:00
implementer	86aa3afbbf	refactor: newsletter signup posts no credential (SEC-14-R1 option a) ... Rework PR #15 per security review SEC-14-R1: the client no longer carries an API token. js/newsletter-config.js ships only the non-secret endpoint, enforced https-only at config load time via validateEndpoint() (mirroring the protocol allowlist in js/reading-list.js); js/newsletter.js POSTs email-only with no Authorization header. Failure paths keep the single user-safe message that never leaks token, endpoint, status, or raw body; success still shows the confirmation. CI gains a gitleaks step that fails on any secret hit; README documents the server-side token, the residual signup-abuse risk, and the authoritative server-side validation follow-up.	2026-08-26 11:27:11 +00:00