Väljalaske kontroll
Release check run 1: six real issues found, all six fixed and live on staging.
- Full Content-Security-PolicyPlanned: needs the map, payment and video origins listed firstParandada
- Visitor text reaches AI models only as dataNo model alone decides a scam or a banKorras
- AI assistants hold no committed merge rightsFixedKorras
- Code scan: script injection, raw SQL, shell, eval, prompt boundaries0 findings in 3,401 filesKorras
- Production dependencies without known advisories9 advisories fixed to 0; trivy 50 to 0Korras
- No hidden time- or count-triggered code0 findings in 1,392 filesKorras
- Only web ports open80 and 443Korras
- Build pipeline actions pinned to exact versionsFive actions pinnedKorras
- Rate limits use the real client addressFixed and checked live on stagingKorras
- Visitor text cannot run as script on BIB sitesStructured data escaping fixed (T-141)Korras
- No secrets in the code's history0 secrets in 13,985 stored filesKorras
- Security headers on every responsenosniff, referrer policy, HSTS, no powered-by; live since 2 Nov 05:44 UTCKorras
- Uploads limited to safe image types and re-encodedJPEG, PNG, WebP onlyKorras
- Signed-in pages and tenant isolationNot checked yet; plannedMärkus