max / makenotwork

• Frontend: kill media-picker XSS; render_string surfaces errors

  Max Johnson 2026-07-01 21:40 b7b048f

• DB concurrency: project-split lock, issue retry/search, webhook claim

  Max Johnson 2026-07-01 21:26 c57008d

• Harden caching, malware quarantine, and account-cleanup fail modes

  Max Johnson 2026-07-01 21:09 a6fd76d

• Cap platform credit as spend-once balance; authenticate inbound sender

  Max Johnson 2026-07-01 20:53 ce0a459

• Drain scheduler on shutdown; escape filename in upload-queue row

  Max Johnson 2026-07-01 18:17 e0b8582

• Gate OTA artifact serving on a malware scan

  Max Johnson 2026-07-01 18:13 28927b4

• Storage: atomic quarantine purge, scan-job retry budget, honest signing chips

  Max Johnson 2026-07-01 17:47 d2d472c

• Scope internal-API identity to a signed SSH-authenticated assertion

  Max Johnson 2026-07-01 17:35 4192670

• Harden invites and TOTP replay; add enum-drift guard

  Max Johnson 2026-07-01 17:04 4835beb

• Fix all-free cart promo reservation and CSV negative-subdollar parse

  Max Johnson 2026-07-01 16:34 7045240

• Support video clips in dynamic insertions

  Max Johnson 2026-07-01 15:56 8a9ca19

• Make the CLI upload confirm idempotent on replay (ultra-fuzz Run 12 Storage)

  Max Johnson 2026-07-01 15:13 03e2a7b

• Surface fragment render errors and de-fragilize two UX sinks (ultra-fuzz Run 12 UX)

  Max Johnson 2026-07-01 14:44 eedac53

• Memoize discover facets and CDN-cache /economics (ultra-fuzz Run 12 Performance)

  Max Johnson 2026-07-01 14:34 c5a54ba

• Harden the OTA path and stop orphaning S3 on failed cleanup enqueue (ultra-fuzz Run 12 Storage)

  Max Johnson 2026-07-01 14:14 7a8c406

• Sync Cargo.lock to v0.10.7

  Max Johnson 2026-07-01 14:00 44dc82f

• Stop CDN-caching the private feed and couple cache invalidation to deletion (ultra-fuzz Run 12 Security)

  Max Johnson 2026-07-01 14:00 6e22025

• Redeliver inbound Postmark email on transient failure (ultra-fuzz Run 12 doubledown)

  Max Johnson 2026-07-01 13:52 0b67d6f

• Fund the Fan+ credit from the platform, not the creator (ultra-fuzz Run 12 Payments)

  Max Johnson 2026-07-01 13:39 7a78878

• Release server v0.10.7

  Max Johnson 2026-07-01 12:04 75fd955

• server: hide grid results in list view on discover page

  Max Johnson 2026-07-01 12:04 c68af8b

• Reject zero-width and bidi characters in display names and link titles (ultra-fuzz Run 10 UX N1)

  Max Johnson 2026-06-30 19:18 39ed9e1

• Surface HTMX errors on every route and de-panic redirects (ultra-fuzz Run 11 UX)

  Max Johnson 2026-06-30 18:46 f361c2f

• Cut dashboard/discover/feed query cost and stop orphaning builds (ultra-fuzz Run 11 Performance)

  Max Johnson 2026-06-30 18:36 f801710

• Type the S3 bucket noun and harden multipart/delete (ultra-fuzz Run 11 Storage)

  Max Johnson 2026-06-30 17:57 fb4ac6e

• Consolidate the login gate and type-witness admin writes (ultra-fuzz Run 11 Security)

  Max Johnson 2026-06-30 17:43 1f0c86a

• Type-seal project price writes and tighten money paths (ultra-fuzz Run 11 Payments)

  Max Johnson 2026-06-30 17:14 803b50d

• Enforce price cap on JSON path and stop wizard input loss (ultra-fuzz Run 10 UX)

  Max Johnson 2026-06-30 14:38 947d6f6

• Bound unbounded work and unblock the runtime (ultra-fuzz Run 10 Performance)

  Max Johnson 2026-06-30 14:28 c906608

• Require CDN in production and tighten storage key checks (ultra-fuzz Run 10 Storage)

  Max Johnson 2026-06-30 14:13 5716d14