Owner decisions / small cleanups from the pre-release pentest, none blocking the release:
Attachment pastes show size 0 in /api/public and history tables (pastes.size never set; view pages correct).
Create response URLs use the random ID even when custom_slug was set (both resolve; cosmetic).
Paste view pages have no
Owner decisions / small cleanups from the pre-release pentest, none blocking the release:
1. Attachment pastes show size 0 in /api/public and history tables (pastes.size never set; view pages correct).
2. Create response URLs use the random ID even when custom_slug was set (both resolve; cosmetic).
3. Paste view pages have no <title> element (title injection is properly escaped, no XSS).
4. /f/{aid}/{filename} ignores the filename component (no traversal; decorative-name disguise only).
5. go-enry returns None/type: text for clearly-Go pastes on dev build (observed during README screenshots; check whether prod detects correctly before treating as a bug).
fen
added the Low label 2026-09-18 01:25:33 +00:00
Prod check for item 5: created an identical small Go paste on p.archfox.org (p3jyh5) and palette-dev (hs86th). Both GET /api/pastes/{id} return language: null and the paste pages show no language badge. So the go-enry miss (None / type: text for clearly-Go content) reproduces on PROD too, not just the dev build. Record-only note; no fix dispatched per the issue's owner-decision scope.
Prod check for item 5: created an identical small Go paste on p.archfox.org (p3jyh5) and palette-dev (hs86th). Both GET /api/pastes/{id} return language: null and the paste pages show no language badge. So the go-enry miss (None / type: text for clearly-Go content) reproduces on PROD too, not just the dev build. Record-only note; no fix dispatched per the issue's owner-decision scope.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Owner decisions / small cleanups from the pre-release pentest, none blocking the release:
Prod check for item 5: created an identical small Go paste on p.archfox.org (p3jyh5) and palette-dev (hs86th). Both GET /api/pastes/{id} return language: null and the paste pages show no language badge. So the go-enry miss (None / type: text for clearly-Go content) reproduces on PROD too, not just the dev build. Record-only note; no fix dispatched per the issue's owner-decision scope.