Skip to content

Locked Down & Re-Lit

Latest
Latest

Choose a tag to compare

View all tags
@CodeMeAPixel CodeMeAPixel released this 11 Jul 20:34
· 4 commits to master since this release
v2.0.0-beta.3
5891425

Security

  • Add SSRF protection for URL analysis: submitted URLs are validated against private, loopback, link-local, CGNAT, and cloud-metadata addresses (resolving DNS, not just string-matching), and every redirect hop is re-validated before it is fetched.
  • Fix the request rate limiter, which keyed every request on a single shared "global" bucket — it now keys on the real client IP so one visitor can no longer exhaust everyone's quota.

Added

  • nixpacks.toml for one-command Nixpacks deployment on dokploy/Coolify.
  • server.mjs Node entry (via srvx) that actually binds an HTTP listener for bun run start.
  • Vitest unit tests covering the SSRF URL guard, the rate limiter, and slop detection.
  • Completed neutral color scale (steps 5–10) and a theme-aware accent color, plus reusable .accent-pill and .section-card utilities.

Changed

  • Unified the accent color system so it is consistent per theme — pink in light mode, orange in dark mode — across the nav, analyzer form, hero, result tabs, scanner, and suggestion cards (replaced scattered hardcoded hex values with theme-aware tokens).
  • Made the hero headline gradient and input focus rings theme-aware instead of hardcoded pink.
  • Upgraded the Vercel AI SDK (ai 3 → 6, @ai-sdk/openai 0.0.x → 3) and adapted the generateObject call to the new API.
  • Wired Sentry error capture into the previously-silent external-call failure paths (SEO fetch, PageSpeed, AI suggestions).
  • AI suggestion failures now log a concise, actionable message and fall back immediately to rule-based suggestions instead of retrying and dumping full stack traces (common when the OpenAI key is out of quota).
  • Canonicalized Tailwind v4 utility classes (bg-gradient-to-* → bg-linear-to-*).

Fixed

  • Fixed a broken production start: the built server only exported a fetch handler and never opened a listener, so npm start exited without serving. It now binds a real HTTP server on PORT/HOST.
  • Defined the missing light10/dark10 color tokens, which were rendering with the wrong inherited color on the hero tagline and the error, 404, and disclaimer pages.
  • Fixed a React list-key in StatsBar that referenced a nonexistent field.

Removed

  • Removed leftover Cloudflare Workers deployment config (wrangler.jsonc, @cloudflare/vite-plugin, wrangler) that conflicted with the Node/Docker deployment target.

Full Changelog: v2.0.0-beta.2...v2.0.0-beta.3

Assets 2
Loading