-
perf: scan timeouts on both paths, supervise+lock monitor, background appeal fan-out
-
storage: abort multipart upload on completion failure
-
security: seal git-push CSRF, close 7z/RAR polyglot evasion, exhaustive sanitizer allowlists
-
payments: close refund crash-window, seal enforcement_mode enum, license-key idempotency
-
ux: build OAuth redirects with real URL parsing (preserve query + fragment)
-
perf: set-based sync-log compaction, off-runtime quota walk, bounded scan lookups
-
security: close OAuth silent-consent gap, ClamAV fail-open observability, 7z/RAR + blame hardening
-
payments: enum-type SyncKit billing_status, seal single-live-subscription invariant
-
Release server v0.10.6
-
Background Stripe fan-outs and close perf cliffs (ultra-fuzz Run 6 Performance)
-
Harden git SSH limits and expand YARA corpus (ultra-fuzz Run 6 Security)
-
ux: extract all executable inline JS from templates into static files
-
ux: drop dead price validator, control-char parity on labels, bound discover price filters
-
perf: daily-gate grace hiding, concurrent appeal resumes, batch push-ref issue lookups
-
storage: cover liveness by bare s3_key; ranged read for media sniff
-
security: regression test for TOTP-decrypt fallthrough to backup codes
-
payments: document idempotency storage is consumed by the global middleware
-
ux: clamp library feed pagination like sibling paginators
-
perf: stream content-export files through a disk spool, not a full RAM buffer
-
storage: require positive image signature at media confirm; cap build log at SQL layer
-
security: fall through to backup codes on TOTP decrypt failure
-
ux: field-error highlighting, csrf guards, dead-code + doc cleanup (ultra-fuzz Run 4, A+)
-
perf: stream CSV exports + close hot/cold-path inefficiencies (ultra-fuzz Run 4, A+)
-
synckit: document blob content-addressing trust model (ultra-fuzz Run 4 Storage A+)
-
security: seal token-liveness, per-key identity, private-repo issue authz (ultra-fuzz Run 4, A+)
-
payments: idempotent re-runnable webhook finalize (ultra-fuzz Run 4 M-Pay1, A+)
-
storage+sanitizer: dedup confirm HEAD calls; seal custom-pages URL-attribute allowlist (ultra-fuzz NOTE tail)
-
totp: gate confirm on step monotonicity, unifying it with the login replay rule (ultra-fuzz NOTE tail)
-
payments: v2 webhook retry-queue parity + document get_transaction_by_id authz contract (ultra-fuzz NOTE tail)
-
validation: reject control characters in bio and sync device name (ultra-fuzz NOTE tail)