Skip to content

v1.1.1 — Security hardening and review findings

Choose a tag to compare

View all tags
@vnykmshr vnykmshr released this 23 Feb 23:00
v1.1.1
7e85cec

Addresses 21 findings from Linus peer review (2 HIGH, 10 MEDIUM, 9 LOW). All findings resolved — zero deferred.

Security (HIGH)

  • timingSafeCompare no longer leaks token length via early return — pads shorter input, XORs all bytes with length-mismatch flag
  • sessionStorage.getItem in spec.astro wrapped in try-catch for private browsing / storage-disabled environments
  • deploy.yml actions pinned to commit SHAs (supply chain hardening)

Worker (MEDIUM)

  • Corrupt KV values preserved for inspection instead of silently overwriting
  • Stats endpoint reads count from KV metadata — eliminates N+1 individual get() calls
  • Float stepIndex values rejected at dimensional key boundary
  • OPTIONS preflight scoped to /api/event and /api/stats only
  • MAX_PAYLOAD_BYTES → MAX_PAYLOAD_CHARS (honest naming)
  • compatibility_date bumped to 2025-12-01

Frontend (MEDIUM)

  • create.astro shows error UI when sessionStorage write fails (instead of navigating to blank page)
  • Prompt extraction regex centralized as extractSuggestedPrompt() export
  • Variable shadow fixed (raw → feedbackRaw)

Core Library

  • needsWorkerProxy handles 'other' data source with public scale
  • Dead 'other' removed from HostingPlatform type
  • sectionBudgetMath accepts tier param (no redundant recomputation)
  • hasExternalData/hasUserContent → hasResolvedExternalData/hasResolvedUserContent

Infrastructure

  • OG image converted from SVG to PNG for social crawler compatibility
  • Node engine requirement bumped from >=18 to >=22 (matches CI)

Tests

  • 93 tests (7 new) — all passing
  • Mock KV updated with metadata support
  • New tests: corrupt value skip, float rejection, OPTIONS scoping, 'other' data source, prompt extraction

Full changelog: https://github.com/1mb-dev/gistapp/blob/main/CHANGELOG.md

Assets 2
Loading