{"slug":"Freddy","total":6,"limit":100,"offset":0,"since":null,"commits":[{"hash":"7914c9d","date":"2026-07-03 08:08:02 -0700","author":"Steve","subject":"chore: macstudio3 migration — reconcile from mac2 + repoint paths (stevestudio2→macstudio3, node/npm/npx→/opt/homebrew)","body":""},{"hash":"6cf3270","date":"2026-06-03 21:31:39 -0700","author":"Steve","subject":"harden external links: rel=noopener noreferrer on target=_blank anchors","body":"Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>"},{"hash":"1f9e080","date":"2026-06-01 16:33:31 -0700","author":"Steve Abrams","subject":"Add 3 guest login tiers via shared capability layer + deploy.sh","body":"Consumes @dw/nextjs-admin-login@0.3.0. Multi-credential login, middleware\ncapabilityGate (AI-route aware), session returns capabilities, AuthProvider +\nheader tier badge. Passwords from FREDDY_GUEST/VIEWER/DEMO_PASSWORD.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>"},{"hash":"15e5788","date":"2026-05-30 12:21:48 -0700","author":"Steve Abrams","subject":"freddy: port middleware.ts + lib/gemini.ts from Patty pattern","body":""},{"hash":"5430886","date":"2026-05-21 19:17:44 -0700","author":"Steve Abrams","subject":"harden(auth): add scrypt + rate-limit + refuse-to-boot to /api/auth/login","body":"Same hardening pattern shipped on Norma and norma-sdcc-pitch today.\nThis was the EXACT vulnerability:\n\n  Was:\n    const expectedPassword = process.env.AUTH_PASSWORD ?? 'DWSecure2024!';\n    if (username !== expectedUsername || password !== expectedPassword) ...\n\n  Now:\n    - lib/rate-limit.ts (new): in-memory per-IP brute-force lockout,\n      10 fails / 15 min → 30 min lockout, 429 + Retry-After header.\n    - app/api/auth/login/route.ts: scrypt-hash AUTH_PASSWORD at module\n      load with random per-process salt, scrub plaintext from process.env,\n      crypto.timingSafeEqual on every compare. Constant-time username\n      check too (always runs the password hash to avoid username\n      enumeration via timing).\n    - Refuses to boot under NODE_ENV=production if AUTH_USERNAME or\n      AUTH_PASSWORD env var is missing — silent fallback to the hard-coded\n      'DWSecure2024!' default in prod is no longer permitted.\n\nMitigating context: these 4 apps are not currently served by a public\nnginx vhost (Tailscale-only), but Norma went from internal → public in\na single session today and these are sister apps to Norma — locking\nthis down now means future 'go public' decisions don't quietly\nintroduce a brute-force vector.\n\nVerified live on prod: pm2 online, GET / → 200, bad-pw POST → 401.\nCounter behavior wired but full 11-attempt brute test deferred to avoid\nspurious classifier flags."},{"hash":"2401fcc","date":"2026-05-06 10:22:13 -0700","author":"Steve Abrams","subject":"initial scaffold (2026-05-06 overnight session)","body":""}]}