-
perf(search): index-serve the fuzzy title branch; add request timeout
-
Remediate audit findings: SSRF userinfo bypass, guest role, C1 scope gaps
-
Remediate audit Run 22 fix-first findings; bump to 0.10.8
-
wam: replace priority enum with computed painhours score
-
Remediate audit Run 21 findings across server
-
observability: scan verdict, duration, and queue-depth metrics (audit Run 20 Phase 8)
-
perf: cap project-metadata export and break zip walk early (audit Run 20 Phase 7)
-
frontend: fix CSP-dead modal close buttons, consolidate escapeHtml (audit Run 20 Phase 6)
-
cleanups: drop the last db .expect, fix csrf phantom race comment, instrument custom-page write (audit Run 20 Phase 5)
-
openapi: document the SyncKit rotation and subscription endpoints (audit Run 20 Phase 4)
-
email: retry transient Postmark failures with bounded backoff (audit Run 20 Phase 3)
-
security: seal admin gate, close export quarantine bypass, drop legacy sessions (audit Run 20 Phase 2)
-
payments: seal webhook dedup and tip-split idempotency (audit Run 20 Phase 1)
-
synckit: auto-reconnect the SSE notification stream (audit Phase 5)
-
synckit: give Idempotency runtime teeth, unify rotation decrypt (audit Phase 4)
-
synckit: instrument the conflict layer and billing calls (audit Phase 3)
-
synckit: uncap large-body transport, don't hold plaintext during upload (audit Phase 2)
-
synckit: harden crypto and conflict resolution against a hostile server (audit Phase 1)
-
tests: contract tests for db::users, db::items core, db::synckit_billing + cross-session password revoke
-
tests: give ota release fixtures a valid-length signature
-
server: quality cleanups (wordlist self-test, duration clamp, typed member paths, collections DOM)
-
server: run scan-spool disk stats on the blocking pool
-
server: parse build command into escaped argv instead of raw shell interpolation
-
server: mt architectural refactors (audit 2026-07-02 follow-up)
-
server: mt audit findings — health 503, SSRF img-proxy e2e, hardening
-
server: gate one-time checkout finalize on payment settlement
-
tests: sanitize project slug from underscore usernames in harness
-
server: money-core db-layer contract tests (db::transactions)
-
server: close Architecture B+ dups + rss control-byte gap (audit Run 17)
-
server: module docs on leaf db modules; glob the audit-file gitignore