Fabrika/PersonalBlog
8
0
Fork 1
Code Issues 305 Pull Requests Actions Packages Projects 1 Releases Wiki Activity
39 Commits 1 Branch 0 Tags
e186faeb44f050320fa1af3a319aae6bf7c823a1
Commit Graph
5 Commits
Author SHA1 Message Date
kpcto 94c1019a6f Update .gitea/workflows/ci.yml
CI / Run tests (pull_request) Successful in 21s
Details
CI / Secret scan (gitleaks) (pull_request) Successful in 57s
Details
2026-08-26 18:17:41 +00:00
kpcto 39587532c6 Update .gitea/workflows/ci.yml
CI / Run tests (pull_request) Successful in 28s
Details
CI / Secret scan (gitleaks) (pull_request) Failing after 13s
Details
2026-08-26 18:02:07 +00:00
kpcto d7740e3819 Update .gitea/workflows/ci.yml
CI / Run tests (pull_request) Failing after 21s
Details
CI / Secret scan (gitleaks) (pull_request) Failing after 13s
Details
2026-08-26 17:56:07 +00:00
implementer 86aa3afbbf refactor: newsletter signup posts no credential (SEC-14-R1 option a)
CI / Secret scan (gitleaks) (pull_request) Failing after 12s
Details
CI / Run tests (pull_request) Successful in 15s
Details 
Rework PR #15 per security review SEC-14-R1: the client no longer carries
an API token. js/newsletter-config.js ships only the non-secret endpoint,
enforced https-only at config load time via validateEndpoint() (mirroring
the protocol allowlist in js/reading-list.js); js/newsletter.js POSTs
email-only with no Authorization header. Failure paths keep the single
user-safe message that never leaks token, endpoint, status, or raw body;
success still shows the confirmation. CI gains a gitleaks step that fails
on any secret hit; README documents the server-side token, the residual
signup-abuse risk, and the authoritative server-side validation follow-up.
 2026-08-26 11:27:11 +00:00
bot-implementer 6aabecbe76 chore: add CI workflow running the test suite 2026-08-25 10:44:14 +00:00