wizwar6e

Files

T

Eric WagonerandClaude Fable 5 a8a63cc27b The share card stops trusting request headers

Host and x-forwarded-proto are attacker-writable and were interpolated
raw into the share page's meta attributes. The proto must now be
literally http or https, and the host is HTML-escaped like everything
else that reaches the head.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-23 17:42:20 -04:00

banter.ts

The banter moves to its own book, and learns new verses

2026-08-16 22:38:45 -04:00

index.ts

The share card stops trusting request headers

2026-08-23 17:42:20 -04:00

ogimage.ts

Share a turn with the world: /watch links, cards and chrome included

2026-08-23 17:34:00 -04:00

rooms.ts

Share a turn with the world: /watch links, cards and chrome included