Mike a0e6ff1044 Merge pull request 'security: stop trusting the leftmost x-forwarded-for for rate limits and abuse quotas (FRE-371)' (#1) from agent-security-engineer/freno-dev:freno-dev/FRE-371-trusted-client-ip-clean into master ...

Reviewed-on: #1

2026-11-04 10:58:26 -05:00

..

api

analytics: make each weekly funnel stage separately measurable (FRE-366)

2026-10-29 17:02:39 +00:00

email-templates

chore: remediate pygienium audit findings

2026-08-11 13:36:18 -04:00

lib

security(p8): consolidate remediation + regression gate (tasks 02-11)

2026-07-22 20:21:25 -04:00

security

security: stop trusting the leftmost x-forwarded-for for rate limits and abuse quotas (FRE-371)

2026-10-30 05:06:54 +00:00

analytics-retention.test.ts

analytics: fix the two FRE-369 findings in the funnel instrumentation

2026-10-29 18:05:44 +00:00

analytics-retention.ts

analytics: fix the two FRE-369 findings in the funnel instrumentation

2026-10-29 18:05:44 +00:00

analytics-schema.test.ts

analytics: make each weekly funnel stage separately measurable (FRE-366)

2026-10-29 17:02:39 +00:00

analytics-schema.ts

analytics: make each weekly funnel stage separately measurable (FRE-366)

2026-10-29 17:02:39 +00:00

analytics.ts

analytics: fix the two FRE-369 findings in the funnel instrumentation

2026-10-29 18:05:44 +00:00

apple-notification-store.ts

cairn work

2026-01-21 01:56:54 -05:00

apple-notification.ts

cairn work

2026-01-21 01:56:54 -05:00

audit.test.ts

chore: remediate pygienium audit findings

2026-08-11 13:36:18 -04:00

audit.ts

chore: remediate pygienium audit findings

2026-08-11 13:36:18 -04:00

auth.ts

feat: add Nessa club events router (CRUD/RSVP/participants), suppress expected JWT verify logs, drop unused GOOGLE_CLIENT_ID env

2026-07-22 22:23:44 -04:00

backfill-downloads.test.ts

downloads: track every door and surface them on /analytics

2026-10-22 12:59:48 -04:00

backfill-downloads.ts

downloads: track every door and surface them on /analytics

2026-10-22 12:59:48 -04:00

bug-report-rate-limit.ts

nook bug reporting handler

2026-09-01 17:44:20 -04:00

cache.ts

chore: remediate pygienium audit findings

2026-08-11 13:36:18 -04:00

conditional-parser.test.ts

session state simplification

2026-01-12 09:24:58 -05:00

conditional-parser.ts

session state simplification

2026-01-12 09:24:58 -05:00

database.ts

nessa: retire the API copy now served by nessa-api.freno.me

2026-10-13 13:54:14 -04:00

db-connections.ts

nessa: retire the API copy now served by nessa-api.freno.me

2026-10-13 13:54:14 -04:00

device-utils.ts

chore: remediate pygienium audit findings

2026-08-11 13:36:18 -04:00

email.ts

hopeful

2026-01-07 20:19:26 -05:00

feature-flags.ts

removed excess comments

2026-01-04 11:14:54 -05:00

fetch-utils.test.ts

chore: remediate pygienium audit findings

2026-08-11 13:36:18 -04:00

fetch-utils.ts

turnstile added

2026-05-28 10:24:23 -04:00

init-audit-table.ts

removed excess comments

2026-01-04 11:14:54 -05:00

nook-lifecycle.ts

nook: capture trial email and run the two lifecycle emails

2026-10-04 23:22:24 -04:00

nook.ts

nook: capture trial email and run the two lifecycle emails

2026-10-04 23:22:24 -04:00

password.ts

removed excess comments

2026-01-04 11:14:54 -05:00

provider-helpers.ts

chore: remediate pygienium audit findings

2026-08-11 13:36:18 -04:00

pvp-rewards.test.ts

pvp: make the blood token ledger server-authoritative

2026-10-06 10:56:29 -04:00

pvp-rewards.ts

pvp: make the blood token ledger server-authoritative

2026-10-06 10:56:29 -04:00

pvp-schema.test.ts

pvp: make the blood token ledger server-authoritative

2026-10-06 10:56:29 -04:00

pvp-schema.ts

pvp: make the blood token ledger server-authoritative

2026-10-06 10:56:29 -04:00

request-client.test.ts

analytics: fix the two FRE-369 findings in the funnel instrumentation

2026-10-29 18:05:44 +00:00

request-client.ts

analytics: fix the two FRE-369 findings in the funnel instrumentation

2026-10-29 18:05:44 +00:00

security.ts

security: stop trusting the leftmost x-forwarded-for for rate limits and abuse quotas (FRE-371)

2026-10-30 05:06:54 +00:00

site-context-server.ts

analytics: make each weekly funnel stage separately measurable (FRE-366)

2026-10-29 17:02:39 +00:00

track-download.ts

analytics: make each weekly funnel stage separately measurable (FRE-366)

2026-10-29 17:02:39 +00:00

trusted-client-ip.test.ts

security: stop trusting the leftmost x-forwarded-for for rate limits and abuse quotas (FRE-371)

2026-10-30 05:06:54 +00:00

trusted-client-ip.ts

security: stop trusting the leftmost x-forwarded-for for rate limits and abuse quotas (FRE-371)

2026-10-30 05:06:54 +00:00

utils.ts

revert bundle change

2026-01-07 20:34:23 -05:00

utm.test.ts

nook marketing - utm, analytics, etc

2026-10-03 11:03:26 -04:00

utm.ts

nook marketing - utm, analytics, etc

2026-10-03 11:03:26 -04:00

weekly-metrics.test.ts

analytics: fix the two FRE-369 findings in the funnel instrumentation

2026-10-29 18:05:44 +00:00

weekly-metrics.ts

analytics: fix the two FRE-369 findings in the funnel instrumentation

2026-10-29 18:05:44 +00:00