Michael Freno 3bb3e80b77 security: lock down public S3 procedures and sanitize keys (p8-001, p8-008) ...

- Convert simpleDeleteImage, deleteImage, getPreSignedURL, listAttachments
  from publicProcedure to csrfProtectedProcedure
- Add S3 type allowlist validation to prevent path traversal
- Sanitize title/filename inputs for S3 key construction
- Add ownership checks on delete operations
- Remove hashPassword/checkPassword procedures (bcrypt internals)
- Add regression tests for sanitization and validation

Fixes: p8-001 (anonymous S3 deletion), p8-008 (public presigned URL with unsanitized type)

2026-07-22 17:37:58 -04:00

public

marketing page

2026-02-09 19:53:50 -05:00

scripts

adjust email/pass addition flow, blog ttl extended

2026-01-07 21:21:27 -05:00

src

security: lock down public S3 procedures and sanitize keys (p8-001, p8-008)

2026-07-22 17:37:58 -04:00

.gitignore

fix: duplication error

2026-01-21 12:57:58 -05:00

AGENTS.md

continued nojs improvements

2025-12-22 15:37:47 -05:00

app.config.ts

security cleanup, fix turnstile

2026-05-28 16:48:06 -04:00

bun.lockb

(sidebar)forget redis, better parallization

2026-04-06 13:32:46 -04:00

package.json

(sidebar)forget redis, better parallization

2026-04-06 13:32:46 -04:00

prettier.config.ts

starting refinement

2025-12-17 13:51:13 -05:00

tsconfig.json

init

2025-12-16 22:42:05 -05:00

vercel.json

hopefully this solves random hanging

2026-01-07 20:53:21 -05:00

Description

No description provided

130 MiB

Languages

TypeScript 61.3%

JavaScript 36.8%

CSS 1.1%

HTML 0.5%

Shell 0.3%