wizwar6e

T

Eric WagonerandClaude Fable 5 a8a63cc27b The share card stops trusting request headers

Host and x-forwarded-proto are attacker-writable and were interpolated
raw into the share page's meta attributes. The proto must now be
literally http or https, and the host is HTML-escaped like everything
else that reaches the head.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-23 17:42:20 -04:00

.claude/skills/wizwar-audits

The telepath audit becomes a guard test, and the audits get a skill

2026-08-23 12:01:22 -04:00

deploy

Credibility pass: the accretion sanded smooth

2026-08-21 10:58:08 -04:00

packages

The share card stops trusting request headers

2026-08-23 17:42:20 -04:00

research

The maze performs: doors swing, walls die loudly, homes wear their colors