max / makenotwork

• Close security gaps from ultra-fuzz Run 10 (Security axis)

  Max Johnson 2026-06-30 14:06 b2e6376

• Tighten checkout guards and document promo use semantics (ultra-fuzz Run 10 Payments)

  Max Johnson 2026-06-30 13:49 111861a

• Run CPU-bound Argon2 off the async runtime (ultra-fuzz Run 10 C1)

  Max Johnson 2026-06-30 13:39 ea22104

• Route custom-pages dollars() through the canonical formatter

  Max Johnson 2026-06-25 05:14 de16361

• Give scheduler lock a dedicated pool; drain worker quarantine spawns

  Max Johnson 2026-06-25 05:12 e9ecf1b

• Run item-cover idempotency check before the storage-cap check

  Max Johnson 2026-06-25 05:06 0994faa

• Enforce >=32-char floor on service secrets; sanitize spool suffix

  Max Johnson 2026-06-25 05:01 fed7af7

• Store NULL, not "unknown", for PI-less transaction completions

  Max Johnson 2026-06-25 04:58 4ab32de

• Surface server error messages on HTMX failures; inline profile errors

  Max Johnson 2026-06-25 04:29 9206c0d

• Kill route N+1s, parallelize builds by host, unify scan entry points

  Max Johnson 2026-06-25 04:01 bacacb7

• Harden ClamAV to fail-closed; drop dead code; anti-spray rate-limit

  Max Johnson 2026-06-25 03:33 5dd4ce3

• Fix inline item-edit price-zeroing; guard refund double-submit

  Max Johnson 2026-06-25 03:19 6db89d5

• ux: seal cookie-auth mutations to the CsrfRouter, at-rule + XSS tests

  Max Johnson 2026-06-25 01:37 1172a83

• perf: one maintenance scheduler, shared scan external-lookup helper

  Max Johnson 2026-06-25 01:09 5a70e76

• storage: make multipart abort-on-failure structural

  Max Johnson 2026-06-25 00:46 0cb8326

• security: owner-scope blog/item mutations, polyglot + moderation tests

  Max Johnson 2026-06-25 00:42 63e6a80

• payments: seal StripeAccountId + cart ItemType, add DB-layer tests

  Max Johnson 2026-06-25 00:07 b412e48

• ux: friendly errors for validated extractors, widen hide/strobe guards, posture+clamp fixes

  Max Johnson 2026-06-24 23:13 832b7b7

• perf: scan timeouts on both paths, supervise+lock monitor, background appeal fan-out

  Max Johnson 2026-06-24 22:46 69ab513

• storage: abort multipart upload on completion failure

  Max Johnson 2026-06-24 22:16 5540d16

• security: seal git-push CSRF, close 7z/RAR polyglot evasion, exhaustive sanitizer allowlists

  Max Johnson 2026-06-24 22:16 240a4ca

• payments: close refund crash-window, seal enforcement_mode enum, license-key idempotency

  Max Johnson 2026-06-24 21:47 d69642c

• ux: build OAuth redirects with real URL parsing (preserve query + fragment)

  Max Johnson 2026-06-24 20:32 e2b6070

• perf: set-based sync-log compaction, off-runtime quota walk, bounded scan lookups

  Max Johnson 2026-06-24 20:17 9e62bf7

• security: close OAuth silent-consent gap, ClamAV fail-open observability, 7z/RAR + blame hardening

  Max Johnson 2026-06-24 19:59 6fcfeee

• payments: enum-type SyncKit billing_status, seal single-live-subscription invariant

  Max Johnson 2026-06-24 19:28 9e4852f

• Release server v0.10.6

  Max Johnson 2026-06-24 16:09 d125534

• Background Stripe fan-outs and close perf cliffs (ultra-fuzz Run 6 Performance)

  Max Johnson 2026-06-24 15:39 a57614c

• Harden git SSH limits and expand YARA corpus (ultra-fuzz Run 6 Security)

  Max Johnson 2026-06-24 14:51 f2dec50

• ux: extract all executable inline JS from templates into static files

  Max Johnson 2026-06-24 03:18 b9dd22a