Skip to content

Security quick fixes - #68

Merged
MartinBraquet merged 18 commits into
mainfrom
security-quick-fixes
Nov 5, 2026
Merged

Security quick fixes#68
MartinBraquet merged 18 commits into
mainfrom
security-quick-fixes

Conversation

@MartinBraquet

@MartinBraquet MartinBraquet commented Nov 5, 2026

Copy link
Copy Markdown
Member

No description provided.

MartinBraquet and others added 18 commits November 3, 2026 18:07
@MartinBraquet
Comment out test assertion for "Delete Account" link in site footer.
6546b3e
@MartinBraquet @claude
Restrict un-hiding comments to admins, so an author can't reverse a m…
d068c80 
…oderator's or profile owner's removal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet @claude
Fix message reactions: removing or toggling a reaction now only affec…
f84907f 
…ts the caller's own, not everyone's on that emoji.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet @claude
Key the anonymous rate limit on the real client IP instead of Cloud R…
2ff054f 
…un's front end, and clear expired windows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet @claude
Stop logging failed JWTs and API keys.
1e9c74b 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet @claude
Disable mentions in Discord webhooks, so visitor text can't ping @eve…
dd0e3c2 
…ryone in staff channels.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet @claude
Return a generic message for all 500s, so database details in error m…
cf28a84 
…essages don't reach the client.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet @claude
Make referred_by_username read-only after signup, so members can't …
f1f2a0e 
…inflate referral stats.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet @claude
Require http(s) for event location URLs.
66d5548 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet @claude
Detect Cloud Run from K_SERVICE too, so a missing env var can't mak…
6f006f6 
…e a deployment count as local and skip the internal key check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet @claude
Bump express to 5.2.1.
c5f0ba1 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet @claude
Add X-Frame-Options and Permissions-Policy headers to the web app.
77071fa 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet @claude
Authenticate websocket connections and restrict private topics to the…
4014941 
…ir owner, behind `WS_ENFORCE_TOPIC_AUTH`, and revoke anon reads of `user_notifications`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet @claude
Remove anon inserts on deleted_users, whose only writer is the back…
5f3de36 
…end.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet
Make profile comment websocket broadcasts viewer-neutral, so subscrib…
9b5916a 
…ers refetch with access rules applied.
@MartinBraquet
Refetch profile comments after posting, so showing your own comment d…
1079f93 
…oesn't depend on the websocket.
@MartinBraquet @claude
Reconnect the websocket after the session limit for tabs in use, and …
fb0e698 
…refetch what was missed, while letting idle tabs disconnect so the API can scale to zero.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MartinBraquet
Bump @compass/api to 1.94.0.
207710a
@vercel

vercel Bot commented Nov 5, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
compass Ready Ready Preview Nov 5, 2026 1:26pm UTC

Request Review

@MartinBraquet
MartinBraquet merged commit 3df035c into main Nov 5, 2026
6 checks passed
@coderabbitai

coderabbitai Bot commented Nov 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Explain Change →

Caution

Review failed

The pull request is closed.

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@MartinBraquet
MartinBraquet deleted the security-quick-fixes branch November 5, 2026 13:26
@codecov

codecov Bot commented Nov 5, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 89.60000% with 13 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
backend/api/src/helpers/endpoint.ts 28.57% 5 Missing ⚠️
backend/api/src/app.ts 0.00% 2 Missing ⚠️
backend/shared/src/websockets/helpers.ts 0.00% 2 Missing ⚠️
common/src/api/websocket-client.ts 96.36% 1 Missing and 1 partial ⚠️
backend/shared/src/websockets/server.ts 96.66% 1 Missing ⚠️
common/src/api/schema.ts 0.00% 1 Missing ⚠️

📢 Thoughts on this report? Let us know!

This branch was successfully deployed

1 active deployment
Preview – compass — 207710a5 Deployed Nov 5, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MartinBraquet