-
server: read notes through the index, with search, paging and a feed
-
Alerts that repeat until someone confirms they read them
-
Invite a member to a SyncKit group with an expiring one-use token
-
Choose rate limits at runtime, so CI tests the limiter that ships
-
Add CSP violation reporting
-
Lower the browser upload cap to 2 GiB
-
server: adopt lint block, fix clippy, fmt
-
Add multipart blob sessions for SyncKit
-
server: route promote through multipart copy above 5 GiB
-
Bound scan CPU layers + advertise-refs by wall clock; scope project purchase lookup
-
server: attach per-IP rate limit to guest download route
-
Remediate audit Run 21 findings across server
-
Scope internal-API identity to a signed SSH-authenticated assertion
-
Type-seal project price writes and tighten money paths (ultra-fuzz Run 11 Payments)
-
Harden ClamAV to fail-closed; drop dead code; anti-spray rate-limit
-
perf: scan timeouts on both paths, supervise+lock monitor, background appeal fan-out
-
perf: set-based sync-log compaction, off-runtime quota walk, bounded scan lookups
-
Background Stripe fan-outs and close perf cliffs (ultra-fuzz Run 6 Performance)
-
Harden git SSH limits and expand YARA corpus (ultra-fuzz Run 6 Security)
-
synckit: move usage-warning sends off the scheduler tick onto the bounded pool (ultra-fuzz Run 3 CHRONIC)
-
Sweep Run #22 minors: media presign tier cap, bounded scheduler spawns, session cap
-
Add git personal-access-tokens for HTTPS clone and push
-
Cap git upload-pack child lifetime to bound permit starvation
-
Stream git clone packfile and gate clone concurrency
-
OAuth maturation + HMAC method+path+nonce (close MT S13)