-
Require a claim link for free guest claims too
-
Reconcile git HTTP read access with SSH (honor collaborators)
-
Perf: shared HTTP client; bounded-parallel admin bulk actions
-
Perf: batch bundle lookup; stop gating git info/refs on the clone budget
-
Require a claim link for guest purchases (no email auto-attach)
-
Cap git upload-pack child lifetime to bound permit starvation
-
Remediate Run #21 moderate/low findings
-
Fail closed when ClamAV can't fully scan (CHRONIC S1)
-
Prune processed-webhook dedup markers (bounded growth)
-
Clear Run #20 low/minor audit items
-
Stream git clone packfile and gate clone concurrency
-
Stop cover-image replace from taking published tracks offline
-
test: fix fan_plus_checkout_requires_login for CSRF origin gate
-
OAuth maturation + HMAC method+path+nonce (close MT S13)
-
Remove now-dead KNOWN_PREAUTH_CSRF_GAPS const
-
Close CHRONIC A': posture-independent CSRF origin gate + drop pre-auth skip
-
Add whole-router CSRF coverage manifest + tracker tests
-
Multithreaded second sweep: Community/Storage/UX to A
-
Ultra-fuzz Run #1 remediation: all axes to A-; bump 0.4.0
-
Enforce once-per-individual on comp code redemption
-
Release server v0.10.5
-
Add admin dashboard page for creator-tier comp codes
-
Release server v0.10.4
-
Add creator-tier comp codes via free-trial promo codes
-
Release server v0.10.3
-
server: fix public legal/developer docs
-
Release sando v0.2.2
-
server: expose git_sha on /api/health
-
sando: build-run observability, fast pre-gate, shared build cache
-
Harden server across 5 audit axes (ultra-fuzz Run #19 remediation)