{"slug":"jill-website","total":8,"limit":100,"offset":0,"since":null,"commits":[{"hash":"db59fa4","date":"2026-05-31 16:32:33 -0700","author":"SteveStudio2","subject":"Add per-site favicon (kills /favicon.ico 404)","body":""},{"hash":"e405522","date":"2026-05-19 21:18:55 -0700","author":"SteveStudio2","subject":"security: upgrade rel=noopener to rel=noopener noreferrer on every target=_blank","body":"noopener alone prevents window.opener tampering but still leaks the\nReferer header to third-party destinations. Adding noreferrer closes\nthat side-channel — every outbound restaurant/yoga/surf/tour link in\nthe inline HTML template (server.js + auto-generated index.html) and\nthe EJS partials (index, culinary-delights, surfing, yoga-wellness)\nnow ships the full noopener noreferrer pair.\n\n60 occurrences upgraded across 6 files. Verified zero bare\nrel=noopener occurrences remain outside node_modules/coverage.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>"},{"hash":"5f718fe","date":"2026-05-19 21:16:33 -0700","author":"SteveStudio2","subject":"security: 404-guard snapshot/backup paths in both server entrypoints","body":"Adds a defense-in-depth Express middleware (runs BEFORE express.static)\nthat returns 404 for any request path ending in .bak / .bak.* / .pre-* /\n.orig / .rej / .swp / ~. Applied to both:\n\n- server.js (standalone fallback)\n- src/server.ts (PM2 production entrypoint via dist/server.js)\n\nPairs with the .gitignore broadening in 6087759 — even if a snapshot\nfile slips into public/ via a sloppy edit, it never serves over HTTP.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>"},{"hash":"6087759","date":"2026-05-19 21:15:11 -0700","author":"SteveStudio2","subject":".gitignore: broaden to exclude snapshot/backup/swap files","body":"Prevents editor/sed/patch artifacts (.bak, .pre-*, .orig, .rej, .swp,\n~) from being staged or served — defense-in-depth alongside the\nruntime 404-guard middleware.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>"},{"hash":"53b173b","date":"2026-05-11 10:25:08 -0700","author":"SteveStudio2","subject":"security: scrub hardcoded admin password from CLAUDE.md + add helmet dep","body":"CLAUDE.md was committing the live admin password 'DWSecure2024!' as\nplaintext doc — anyone who cloned the repo had prod credentials. Replaced\nwith a pointer to ADMIN_PASSWORD env var.\n\nhelmet was already require()'d in server.js but missing from\npackage.json/lock — npm install would fail cold. Adding it now.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>"},{"hash":"6852df5","date":"2026-05-11 10:01:50 -0700","author":"SteveStudio2","subject":"security: remove express.static('.') — was exposing .env over HTTP","body":"express.static('.') on the project root was making .env, server.js, node_modules,\npackage.json, etc. fetchable as static files. .env contains real SMTP_PASS and\nDB_PASSWORD. Anything that needs to be public must live in public/.\n\nFound by security-auditor sweep 2026-05-11."},{"hash":"6058b65","date":"2026-05-07 12:29:26 -0700","author":"Steve","subject":"tighten .gitignore: add missing standing-rule patterns (tmp/ .DS_Store build/)","body":""},{"hash":"e97ed54","date":"2026-05-04 05:38:44 -0700","author":"SteveStudio2","subject":"[overnight] pre-debate baseline","body":""}]}