CarterPerez-dev 4382ba5e17 fix(canary): CSP allows challenges.cloudflare.com for Turnstile ... Audit F10: script-src 'self' blocked the Turnstile bootstrap script (https://challenges.cloudflare.com/turnstile/v0/api.js) and its widget iframe. Added challenges.cloudflare.com to script-src, connect-src, and a new frame-src directive so the widget can render under prod CSP.		2026-05-17 19:07:41 -04:00
..
admin	fix(canary-phase12): address audit findings before phase rollup	2026-05-14 07:02:39 -04:00
config	fix(canary): dev nginx routes /c/, /k/, /api/ to canary + manage_url defaults to base_url	2026-05-17 18:12:09 -04:00
core	fix(canary): replace //nolint pragmas with explicit error handling	2026-05-13 13:28:44 -04:00
event	feat(canary): Event.AttachGeoIP + event.Service geo enrichment	2026-05-17 05:24:17 -04:00
geoip	fix(canary-phase13): direct unit coverage for firstSubdivisionName	2026-05-17 05:30:13 -04:00
health	fix(canary): replace //nolint pragmas with explicit error handling	2026-05-13 13:28:44 -04:00
middleware	fix(canary): CSP allows challenges.cloudflare.com for Turnstile	2026-05-17 19:07:41 -04:00
notify	fix(canary-phase10): escape geo wrapping parens for MarkdownV2 before rollup	2026-05-14 00:47:08 -04:00
server	fix(canary-phase1): clear all post-phase-1 audit observations + header normalization	2026-05-10 06:15:26 -04:00
testutil	fix(canary): clear pre-audit lint debt + migrate golangci config to v2	2026-05-12 02:49:56 -04:00
token	feat(canary): admin handler (stats + tokens list + disable) + repo methods	2026-05-14 06:57:28 -04:00
turnstile	feat(canary): turnstile verifier + middleware	2026-05-13 15:08:37 -04:00