157 Commits

Include renames

Author	SHA1	Message	Date
palette-agent	e08cafe9c8	security headers middleware: CSP, Referrer-Policy, nosniff on HTML pages (#59) ... - web.SecurityHeaders middleware wired into the chi router - Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' (page scripts are inline); frame-ancestors 'none' - Referrer-Policy: no-referrer, X-Content-Type-Options: nosniff - Applied only to text/html responses; JSON API and /raw pass through unchanged - Regression test internal/web/securityheaders_test.go	2026-09-09 09:16:42 -05:00
fen	bb5c4f0186	fix #60: apply ValidExpiry clamp to cans create handler (was lost in working tree)	2026-09-09 09:15:39 -05:00
palette-agent	9811191648	admin: per-IP rate limit (5/min) on admin key attempts (#66)	2026-09-09 09:15:01 -05:00
poslop	c288fc73a7	Search: spinner indicator + performance note on client-side filtering (#32) ... - Fix filter fetch to request limit=100 (API max) instead of 500, which the API silently clamped, so filtered results actually cover the fetch window. - Document client-side filtering behavior and limits in README Performance Notes.	2026-09-09 09:13:40 -05:00
Hermes Agent	f6c4342468	Exclude password-protected pastes from public listings (#65) ... ListPublic and its COUNT query now filter password_hash IS NULL, so /api/public (and any page backed by it) no longer leaks metadata (title, slug, existence) of password-protected pastes. Unlisted pastes were already excluded. Adds regression test covering both.	2026-09-09 09:13:26 -05:00
poslop	f611cc3e9e	fix #60: clamp expires_in on cans API (400 on zero/negative, cap 1yr)	2026-09-09 09:13:21 -05:00
poslop	4f1e901f04	Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)	2026-09-09 01:33:39 -05:00