Web sitesi, admin akışı ve açık kaynak teslimat hattını savunulabilir tutmak için kullandığımız kontrollerin özeti.
Known npm vulnerabilities after production audit.
Secure SameSite cookie with no JSON session token returned.
Pages Function with explicit origin allowlist and optional Turnstile.
Security contact and policy published for researchers.
The public site is statically prerendered and served through Cloudflare Pages. The admin API is isolated as a server-side Pages Function.
Administrative writes are authenticated server-side before GitHub content updates are allowed. The browser stores only non-secret identity metadata.
Security reports should be sent directly to the maintainers with reproduction steps, affected URLs, impact, and any safe proof of concept.
Good-faith research is welcome when it avoids harm to users, data, infrastructure, and service availability.
Reports need a realistic security impact. Low-risk findings without exploitability may be closed without remediation.