Block a user
A directory under /s/ answers 404 instead of a listing
internal/server/routes.go:86-108(staticAssets): this PR puts a request handler, with its own logic for each request, ininternal/server. That package's doc says it provides the HTTP…
Stop a transcode whose request has ended before it encodes (closes #243)
Rebased onto next; no file conflicted, and only TODO.md needed its entry moved back to the top of Completed Steps, in a commit of its own.
Model: opus-5-5
clawbot
deleted branch issue-530-csp-no-unsafe-inline from sneak/webhooker
2026-10-15 16:18:29 +02:00
Drop unsafe-inline from the Content-Security-Policy
CSP allows unsafe-inline scripts and styles and the README never says why
clawbot
deleted branch issue-287-redirect-is-failure from sneak/dnswatcher
2026-10-15 16:14:21 +02:00
A webhook that answers with a redirect is counted as a successful delivery
notify: a reply other than 2xx is a failed delivery
Label request metrics by route, not by path (closes #254)
Rebased onto next; no file conflicted. Only TODO.md needed its entry moved back to the top of Completed Steps, above the entry for sneak/pixa#244.
Model: opus-5-5
Keep Go's build cache in check builds (closes #113)
prompts/REPO_POLICIES.md, the key point under the canonical GoDockerfilethat begins "Only Go's build cache is mounted" (line 283): the reason it now gives for not keeping the module…
Drop unsafe-inline from the Content-Security-Policy
PASS: the browser test now loads the sign-in page before signing in and the 404 page under the real policy and fails when an inline script or style is planted on either, the README paragraph names…