Frederic CabassutandClaude Opus 4.6 92d0581186 fix: address PR review — sanitize attachments, SSR safety, a11y ...

- Strip server paths from public attachment responses (new PublicAttachment type)
- Use $page.url.origin instead of window.location.origin (SSR-safe)
- Fix toggle switch left-4.5 → left-[1.125rem] (valid Tailwind)
- Add aria-label to SharingIndicator button for screen readers
- Add opportunistic pruning to IP rate limiter to prevent unbounded growth
- Reduce shared attachment cache to 1 hour (respect share revocation)
- Update OpenAPI schema with PublicAttachment type
- Add unit test asserting server paths are not leaked

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-20 22:06:41 +01:00

..

superpowers/specs

docs: add design spec for public note sharing (#7)

2026-03-20 21:03:44 +01:00

API.md

fix: address PR review — sanitize attachments, SSR safety, a11y

2026-03-20 22:06:41 +01:00

ARCHITECTURE.md

docs: add public sharing to features, architecture, and API docs

2026-03-20 22:06:41 +01:00

AUTH.md

docs: add dedicated AUTH.md and deduplicate auth info across docs

2026-03-09 11:35:12 +01:00

DEPLOYMENT.md

docs: add SMTP config to README, document recent features, expose all env vars in docker-compose

2026-03-12 10:49:55 +01:00

FEATURES.md

docs: add public sharing to features, architecture, and API docs

2026-03-20 22:06:41 +01:00

openapi.yaml

fix: address PR review — sanitize attachments, SSR safety, a11y

2026-03-20 22:06:41 +01:00

TESTING.md

docs: add E2E BDD testing best practices and improve test suite

2026-03-10 23:39:29 +01:00