fen
0 Followers · 0 Following
  • Joined on 2026-09-09
Repositories Projects Packages Public Activity Starred Repositories
fen merged pull request poslop/palette#154 2026-09-10 13:43:21 +00:00
Fix #138: add Secure attribute to viewer cookie (vwr)
fen closed issue poslop/palette#138 2026-09-10 13:43:21 +00:00
[LOW] Viewer cookie (vwr) lacks the Secure attribute
fen pushed to fix-138 at poslop/palette 2026-09-10 13:42:14 +00:00
521b6f8011 #138: add Secure attribute to viewer cookie (vwr)
fe75dfc746 Merge pull request 'Remove ?token= deletion-token path (#143)' (#153) from fix-143 into dev
00aaafeb3c #143: set tok_<id> cookie in create handlers so the created banner can show the token (QA)
d7b51f02b6 Remove ?token= deletion-token path (#143)
Compare 4 commits »
fen deleted branch fix-143 from poslop/palette 2026-09-10 13:41:37 +00:00
fen commented on issue poslop/palette#143 2026-09-10 13:41:35 +00:00
[LOW] Deletion token accepted in the URL (?token=), leaking a bearer secret into logs/history

QA passed on live palette-dev (image @sha256:813958aa..., merge commit fe75dfc on dev).

  • Create flow sets short-lived HttpOnly tok_ cookie (60s); no deletion token appears in any URL…
fen merged pull request poslop/palette#153 2026-09-10 13:38:15 +00:00
Remove ?token= deletion-token path (#143)
fen closed issue poslop/palette#143 2026-09-10 13:38:15 +00:00
[LOW] Deletion token accepted in the URL (?token=), leaking a bearer secret into logs/history
fen pushed to dev at poslop/palette 2026-09-10 13:38:15 +00:00
fe75dfc746 Merge pull request 'Remove ?token= deletion-token path (#143)' (#153) from fix-143 into dev
00aaafeb3c #143: set tok_<id> cookie in create handlers so the created banner can show the token (QA)
d7b51f02b6 Remove ?token= deletion-token path (#143)
Compare 3 commits »
fen pushed to fix-143 at poslop/palette 2026-09-10 13:37:30 +00:00
00aaafeb3c #143: set tok_<id> cookie in create handlers so the created banner can show the token (QA)
d7b51f02b6 Remove ?token= deletion-token path (#143)
b0a58d6ca5 Merge pull request 'Settings: dark toggle above theme list; midnight card light/dark rows swapped' (#134) from fix-settings-order into dev
747eba7064 Settings: dark toggle above theme list; midnight card light row on top (#132)
Compare 4 commits »
fen pushed to fix-143 at poslop/palette 2026-09-10 13:36:49 +00:00
6d17de6ff0 #143: set tok_<id> cookie in create handlers so the created banner can show the token (QA)
fen created pull request poslop/palette#154 2026-09-10 13:32:10 +00:00
Fix #138: add Secure attribute to viewer cookie (vwr)
fen created branch fix-138 in poslop/palette 2026-09-10 13:32:10 +00:00
fen pushed to fix-138 at poslop/palette 2026-09-10 13:32:10 +00:00
b65dd0a24f #138: add Secure attribute to viewer cookie (vwr)
fen deleted branch fix-settings-order from poslop/palette 2026-09-10 13:29:35 +00:00
fen commented on issue poslop/palette#132 2026-09-10 13:29:33 +00:00
Settings: dark toggle above theme list; midnight card light/dark rows swapped

QA passed (#132). Verified on live palette-dev after rollout restart: dark toggle renders ABOVE the Theme heading/theme-grid in the settings menu; midnight pair card shows light variant (midnight-l…

fen created pull request poslop/palette#153 2026-09-10 13:24:23 +00:00
Remove ?token= deletion-token path (#143)
fen created branch fix-143 in poslop/palette 2026-09-10 13:24:05 +00:00
fen pushed to fix-143 at poslop/palette 2026-09-10 13:24:05 +00:00
27763cd1ba Remove ?token= deletion-token path (#143)
fen pushed to dev at poslop/palette 2026-09-10 13:23:30 +00:00
b0a58d6ca5 Merge pull request 'Settings: dark toggle above theme list; midnight card light/dark rows swapped' (#134) from fix-settings-order into dev
747eba7064 Settings: dark toggle above theme list; midnight card light row on top (#132)
Compare 2 commits »
fen closed issue poslop/palette#132 2026-09-10 13:23:29 +00:00
Settings: dark toggle above theme list; midnight card light/dark rows swapped