Consulting Intake

repo: ~/Projects/consulting-intake · 12 commits · 0 in last 24h, 0 in last 7d ·

Search the build

12 commits indexed

  1. 2f22dfc 2026-08-31 update lhf.js SOURCE OF TRUTH comment to include intake portal path
  2. e354af7 2026-08-31 add LHF widget to intake admin command center (fleet pattern parity)
  3. 5027e89 2026-08-30 deploy-safety: exclude data/ from rsync so deploys never clobber prod-written intakes/admin edits (TK-22)
  4. 19e3da0 2026-08-30 Fix creds-in-URL fetch guard on both gated pages (portal/admin) — byte-exact fleet drop-in, standalone files patched directly (TK-22)
  5. 412a186 2026-08-25 creds-safe fetch guard: resolve relative fetch vs credential-free location (creds-in-URL trap)
  6. 6a3fbc6 2026-07-25 chore: lint (intake write try/catch), v0.1.2 (session close)
  7. cdc7067 2026-07-25 harden public /api/intake: per-IP + global rate limiting (no new deps)
  8. c3c30a5 2026-07-19 intake sign-in: hero Ken-Burns pan-zoom + reduced-motion guard (parity with RENTV portal motion layer)
  9. b6ee91b 2026-07-17 chore: v-bump (session close)
  10. 0b5ab1d 2026-07-17 Intake app: rich UX — rotating skyline hero, editorial dark-gold system, restyled questionnaire
  11. cc8c413 2026-07-17 Consulting Intake template home — public questionnaire front door
  12. eb9a624 2026-07-17 scaffold consulting portal for Consulting Intake

Authors

Agents used

  • none detected

Skills used

  • /catch1
  • /intake1
  • /day1

Creative ideas + design notes

Commits with substantial prose (≥120 chars) — the rationale behind each move.

412a186 · 2026-08-25 · creds-safe fetch guard: resolve relative fetch vs credential-free location (creds-in-URL trap) 
Fleet inoculation — opening this basic-auth app with credentials in the URL
poisoned document.baseURI and made relative fetch('/api/…') throw. Guard resolves
non-absolute request URLs against location instead. Ref: creds-in-url-fetch-guard-fleet-pattern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
cdc7067 · 2026-07-25 · harden public /api/intake: per-IP + global rate limiting (no new deps) 
Zero-dependency in-memory sliding-window limiter: 5 submissions/IP/10min plus a
500/day global backstop so distributed spam can't fill intakes.json. trust proxy
so it keys on the real client IP through nginx (X-Forwarded-For), not loopback.
Verified: 5x200 then 429 same-IP; distinct IPs get independent buckets.

File tree

26 files tracked. Click any to browse the source at HEAD.

Other build journals

← Consulting Designerwallcoverings Com  ·  all 4 projects  ·  Consulting Rentv Com →

Export

commits.csv · feed.atom · project.json · commits.json

rendered in 0ms