max / makenotwork

• security: close OAuth silent-consent gap, ClamAV fail-open observability, 7z/RAR + blame hardening

  Max Johnson 2026-06-24 19:59 6fcfeee

• payments: enum-type SyncKit billing_status, seal single-live-subscription invariant

  Max Johnson 2026-06-24 19:28 9e4852f

• Release server v0.10.6

  Max Johnson 2026-06-24 16:09 d125534

• Background Stripe fan-outs and close perf cliffs (ultra-fuzz Run 6 Performance)

  Max Johnson 2026-06-24 15:39 a57614c

• Harden git SSH limits and expand YARA corpus (ultra-fuzz Run 6 Security)

  Max Johnson 2026-06-24 14:51 f2dec50

• ux: extract all executable inline JS from templates into static files

  Max Johnson 2026-06-24 03:18 b9dd22a

• ux: drop dead price validator, control-char parity on labels, bound discover price filters

  Max Johnson 2026-06-24 02:47 3de6ec0

• perf: daily-gate grace hiding, concurrent appeal resumes, batch push-ref issue lookups

  Max Johnson 2026-06-24 02:41 ed25e44

• storage: cover liveness by bare s3_key; ranged read for media sniff

  Max Johnson 2026-06-24 02:32 ea9eb66

• security: regression test for TOTP-decrypt fallthrough to backup codes

  Max Johnson 2026-06-24 02:15 b84e6e9

• payments: document idempotency storage is consumed by the global middleware

  Max Johnson 2026-06-24 02:12 5a31ce3

• ux: clamp library feed pagination like sibling paginators

  Max Johnson 2026-06-24 01:48 f562a1f

• perf: stream content-export files through a disk spool, not a full RAM buffer

  Max Johnson 2026-06-24 01:44 dfde7a9

• storage: require positive image signature at media confirm; cap build log at SQL layer

  Max Johnson 2026-06-24 01:41 3e42941

• security: fall through to backup codes on TOTP decrypt failure

  Max Johnson 2026-06-24 01:36 2a7aeee

• ux: field-error highlighting, csrf guards, dead-code + doc cleanup (ultra-fuzz Run 4, A+)

  Max Johnson 2026-06-24 00:36 84ddb06

• perf: stream CSV exports + close hot/cold-path inefficiencies (ultra-fuzz Run 4, A+)

  Max Johnson 2026-06-24 00:08 c114130

• synckit: document blob content-addressing trust model (ultra-fuzz Run 4 Storage A+)

  Max Johnson 2026-06-23 23:24 cc53cb1

• security: seal token-liveness, per-key identity, private-repo issue authz (ultra-fuzz Run 4, A+)

  Max Johnson 2026-06-23 23:20 108bd59

• payments: idempotent re-runnable webhook finalize (ultra-fuzz Run 4 M-Pay1, A+)

  Max Johnson 2026-06-23 22:32 c929c2b

• storage+sanitizer: dedup confirm HEAD calls; seal custom-pages URL-attribute allowlist (ultra-fuzz NOTE tail)

  Max Johnson 2026-06-23 21:03 83a4e68

• totp: gate confirm on step monotonicity, unifying it with the login replay rule (ultra-fuzz NOTE tail)

  Max Johnson 2026-06-23 20:55 6ef2042

• payments: v2 webhook retry-queue parity + document get_transaction_by_id authz contract (ultra-fuzz NOTE tail)

  Max Johnson 2026-06-23 20:51 7af8fb8

• validation: reject control characters in bio and sync device name (ultra-fuzz NOTE tail)

  Max Johnson 2026-06-23 20:43 ccf8532

• synckit: extract dashboard-tab JS to a static file + close slug-in-onclick (ultra-fuzz --deep UX A+)

  Max Johnson 2026-06-23 20:38 bf7d7c6

• synckit: indexed pull hot path, SSE cursor, deferred egress, sealed warning tick (ultra-fuzz --deep Perf A+)

  Max Johnson 2026-06-23 20:23 0fb3b36

• synckit: invalidate sync tokens on device removal + security audit log (ultra-fuzz --deep Security A+)

  Max Johnson 2026-06-23 20:12 fc0659c

• synckit: ship blob-delete API + fix silently-broken sync_log retention (ultra-fuzz --deep Storage A+)

  Max Johnson 2026-06-23 19:53 f28489d

• ops-exec: pin approved scripts per action on the agent

  Max Johnson 2026-06-23 19:11 167097e

• Seal pricing-format/slug drift and add Cloudflare quarantine cache-purge

  Max Johnson 2026-06-23 19:11 14b7fbf