nmemmertandClaude Sonnet 5.5 2a64f29a00 Second hardening pass: atomic data writes, bible-passage limits, webhook SSRF guard, note sanitizing, CI gates; v2.10.1 ...

- Atomic temp-file + rename for all JSON data writes (no truncated files on crash)
- /api/bible-passage: rate limit, range caps (60 verses), bounded cache
- Admin webhooks: https-only, block private/internal/Tailscale addresses (checked at registration and delivery), no redirects
- Resend webhook token compare is timing-safe
- DOMPurify on rendered study notes and broadcast preview
- CI runs lint + tests before build
- Permissions-Policy and HSTS (production) headers; JSON error handler for /api
- Tests for URL safety and atomic writes

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2026-10-09 09:00:28 -04:00

..

admin-assets.js

Upgrade Asset Manager and Inbox; load Resend templates in Broadcast; v2.5.0

2026-10-01 07:45:50 -04:00

admin-auth.js

Codebase audit: remove dead code, fix broken patterns, consolidate duplicates; v2.0.27

2026-09-17 16:10:31 -04:00

admin-backup.js

Fix 11 bugs: restore crash, draft leak, email failures, memory leaks

2026-07-16 07:48:54 -04:00

admin-content.js

Second hardening pass: atomic data writes, bible-passage limits, webhook SSRF guard, note sanitizing, CI gates; v2.10.1

2026-10-09 09:00:28 -04:00

admin-dashboard.js

Expand admin dashboard with trends, health, study and email insights; v2.8.0

2026-10-01 10:19:25 -04:00

analytics.js

Security & hardening pass: scrypt password hashing, persisted admin sessions, upvote/analytics rate limits, dependency fixes, healthcheck, lint cleanup; v2.10.0

2026-10-09 08:45:39 -04:00

bible-passage.js

Second hardening pass: atomic data writes, bible-passage limits, webhook SSRF guard, note sanitizing, CI gates; v2.10.1

2026-10-09 09:00:28 -04:00

calendar-events.js

Add recurring events, week/day view, drag-to-reschedule, iCal export, and start times to calendar; v1.1.22

2026-07-28 16:46:45 -04:00

contact.js

Second hardening pass: atomic data writes, bible-passage limits, webhook SSRF guard, note sanitizing, CI gates; v2.10.1

2026-10-09 09:00:28 -04:00

downloads.js

One companion study guide per series; v2.9.8

2026-10-08 16:00:52 -04:00

episode-scripts.js

Episode scripts: file by season + episode so numbers can repeat per book; search labels for current series; v2.9.6

2026-10-08 15:31:11 -04:00

episodes.js

Fix 5 bugs: analytics range keys, stale visitor rows, NuggetsPage init state, episodes timer leak, unsanitized nuggets object; v2.0.1

2026-09-08 08:21:02 -04:00

feed.js

v1.1.0 — RSS feed, PWA, lesson comments, progress tracking + streaks

2026-07-22 13:19:25 -04:00

inbound-email.js

Upgrade Asset Manager and Inbox; load Resend templates in Broadcast; v2.5.0

2026-10-01 07:45:50 -04:00

newsletter.js

Retry Resend calls on 429 and throttle Newsletter Archive lookups; v2.7.1

2026-10-01 09:14:49 -04:00

nuggets-host-upload.js

Second hardening pass: atomic data writes, bible-passage limits, webhook SSRF guard, note sanitizing, CI gates; v2.10.1

2026-10-09 09:00:28 -04:00

nuggets.js

Add Nuggets to global search and RSS-sourced scripture refs to index; v2.0.26

2026-09-17 10:27:12 -04:00

public.js

Episode highlights per series: tag by lane, group on Episodes page, move to Finished Book when series ends; v2.9.1

2026-10-08 10:46:33 -04:00

qr-codes.js

Add QR code tracker to admin panel

2026-06-16 09:33:35 -04:00

questions.js

Security & hardening pass: scrypt password hashing, persisted admin sessions, upvote/analytics rate limits, dependency fixes, healthcheck, lint cleanup; v2.10.0

2026-10-09 08:45:39 -04:00

study-account.js

Security & hardening pass: scrypt password hashing, persisted admin sessions, upvote/analytics rate limits, dependency fixes, healthcheck, lint cleanup; v2.10.0

2026-10-09 08:45:39 -04:00

study-auth.js

Security & hardening pass: scrypt password hashing, persisted admin sessions, upvote/analytics rate limits, dependency fixes, healthcheck, lint cleanup; v2.10.0

2026-10-09 08:45:39 -04:00

study-certificate.js

Two concurrent series lanes, Complete studies, self-paced finished books; v2.9.0

2026-10-08 10:14:02 -04:00

study-comments.js

Stop showing email-derived names in student discussions; v2.2.1

2026-09-24 11:15:54 -04:00

study-data.js

Hide Enroll for planned studies (Coming soon) and reject planned enrollments server-side; v2.8.3

2026-10-07 14:56:17 -04:00