Skip to content

Releases: loootai/reverse-engineer

Release list

v0.1.1: admin gate in the template

v0.1.1: admin gate in the template Latest
Latest

Choose a tag to compare

View all tags
@walidboulanouar walidboulanouar released this 11 Oct 11:41
v0.1.1
4aa911d

Security fix for apps scaffolded from template/.

Version 0.1.0 shipped a web UI with no admin authentication. Anyone who could reach a deployed copy could read stored results and start paid looot runs on the operator's token, and the caller of /api/run chose the spend cap. If you built an app from 0.1.0 and run it on a reachable host, upgrade it now: copy src/proxy.ts, src/lib/auth/, src/app/login/, src/app/api/auth/ and the changed src/app/api/run/route.ts from this release, set APP_ADMIN_PASSWORD (12 characters or more), and redeploy.

What changed

  • The template ships the admin gate from looot-reveal v0.2.1: signed session cookie, password check, lockout, CSRF token plus same-origin check, middleware plus a per-route server check.
  • Tests are generated from src/app, so a new route with no gate fails.
  • The web UI spend cap comes from APP_SPEND_CAP_USD on the server. /api/run ignores a cap in the request, always quotes first and allows 10 paid runs a minute per session. The rate limit counts per server instance.
  • Demo mode stays open with a Demo, no sign-in badge and refuses to start next to a real LOOOT_TOKEN.
  • rebuild-on-looot now requires the gate in every scaffolded app, with a checklist, passing gate tests and a Securing a deployment README section.
  • npm run check fails if the template loses the gate files.
Assets 2
Loading

v0.1.0

v0.1.0

Choose a tag to compare

View all tags
@walidboulanouar walidboulanouar released this 11 Oct 11:24
v0.1.0
ee6b43a

First release.

  • Eight skills: reverse-engineer, rebuild-on-looot, request-provider, bounded-probe, site-teardown, evidence-research, competitor-diff, claims-audit.
  • template/: a Next.js starter with a looot client, spend cap, cost ledger, demo mode and a headless CLI with --dry-run.
  • Three case studies in examples/: RB2B to looot-reveal, 6sense to looot-intent, Gojiberry to looot-warm-leads.
  • npm run check lints the skills and checks every job id against the live looot catalog.
  • Claude Code plugin and marketplace manifests, AGENTS.md and llms.txt for other agents.

Not tested: the plugin install itself, Codex and Cursor, and any paid looot run. See the Status section of the README.

Loading