Promote dev → main - #19
Merged
Merged
Conversation
Audit of this public repo confirmed no secrets/tokens are committed (current
tree or full history). Applied defense-in-depth hardening for the few abuse
vectors found:
- api/contact.js: strip control chars (incl. CR/LF) from input so it can't
smuggle structure into the email subject/headers; add a best-effort
per-instance rate limit (5/min/IP -> 429) to blunt floods that would burn
the Resend quota or spam the inbox.
- .github/workflows/promote-to-main.yml: pass `inputs.pr_title` and
`github.actor` through `env` instead of interpolating `${{ … }}` directly
into the run script (avoids the Actions shell script-injection antipattern).
- README: document the contact endpoint's anti-abuse posture and the durable
rate-limit upgrade path.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138qS6baPZutQ7s2fMbfNv3
…canning Headers (vercel.json, applied to all routes): - Strict-Transport-Security (2y, includeSubDomains) — enforce HTTPS. - Permissions-Policy — deny camera/mic/geolocation/browsing-topics. - Content-Security-Policy-Report-Only — locks default-src to 'self' with explicit allowances for the self-hosted bundle/fonts, Vercel Analytics, and the Hugging Face media CDN. Shipped report-only so violations surface in the browser console / report endpoint on the live site before switching to an enforcing `Content-Security-Policy`; the HF CDN redirects to hosts that can't be enumerated from CI, so report-only is the safe first step. Verified locally: production build emits no inline scripts/styles, and serving dist/ with these exact headers returns all first-party assets (JS/CSS/fonts/ SVG/SPA route) 200 — the 'self' policy won't starve the page. Also adds a CodeQL code-scanning workflow (free for public repos) so results land under Security → Code scanning. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0138qS6baPZutQ7s2fMbfNv3
Flipped Content-Security-Policy-Report-Only -> Content-Security-Policy after validating the policy with a headless Chromium against the production build: - Drove the full page (load + lazy-loaded showcase + contact POST) under the policy in ENFORCING mode and observed ZERO securitypolicyviolation events. - Confirmed the Hugging Face media chain resolves huggingface.co (302) -> cas-bridge.xethub.hf.co (206) -> us.aws.cdn.hf.co (206); both CDN hosts are covered by the existing `*.hf.co` allowance, so video posters/clips load. - Confirmed Vercel Analytics loads same-origin (/_vercel/...) under script-src 'self', and the contact form POST passes under connect-src 'self'. Report-only enforced nothing; this makes the policy active. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0138qS6baPZutQ7s2fMbfNv3
…-3l282d security: secrets audit + hardened headers (enforced CSP), CodeQL, contact-endpoint hardening
…scanning The repo's CodeQL default setup (Settings → Code security, event dynamic/github-code-scanning/codeql) is enabled and running, so this advanced workflow is redundant. Two active CodeQL configs produce duplicate analyses and "multiple configurations" warnings. Keep the managed setup (zero-maintenance, auto-updated); remove the workflow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0138qS6baPZutQ7s2fMbfNv3
…-3l282d ci: drop redundant codeql.yml (managed default setup owns code scanning)
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated promotion of
dev→main, dispatched by @AdrianLlopart.