Eric WagonerandClaude Fable 5 a8a63cc27b The share card stops trusting request headers ...

Host and x-forwarded-proto are attacker-writable and were interpolated
raw into the share page's meta attributes. The proto must now be
literally http or https, and the host is HTML-escaped like everything
else that reaches the head.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-23 17:42:20 -04:00

..

src

The share card stops trusting request headers

2026-08-23 17:42:20 -04:00

package.json

Credibility pass: one voice, no scars

2026-08-16 11:56:55 -04:00

tsconfig.json

Scaffold monorepo: engine, server, and web packages

2026-08-15 18:20:16 -04:00