Hardening A/2: close the open routes — decorator order, newsletter relay, request edit link, upload directories, hacker/team PII, deposit amount - #290

Merged

gregv merged 8 commits into

hardening/a-security

Oct 1, 2026

Commits on Sep 30, 2026

security: register auth-gated routes correctly, gate the newsletter relay, constant-time tokens, JSON 413

gregv
and
claude
committed
e0a6389
security: upload-image directory allowlist for non-admins, no overwrite, planning-editor allowance

gregv
and
claude
committed
2df72f5
security: hackathon-request edit link — field allowlist, 404 before email, confirm to the stored contact

gregv
and
claude
committed
8202649
security: strip team internals and member PII from public team payloads; admin-only full-doc route

gregv
and
claude
committed
1e07ded
security: hacker directory allowlist + require_user; deposit webhook never marks an underpaid session paid

gregv
and
claude
committed
beee98f
docs: CLAUDE.md invariants for the PR-A security changes

gregv
and
claude
committed
76e886e
security: explicit jsonify on the upload gate's error response; 413 test route no longer echoes form keys

gregv
and
claude
committed
d3304be
security: upload denial responses come from a module constant table

gregv
and
claude
committed
093890b