Fix timing leak, CORS enforcement, CI race condition, and frontend hardcoding - #84

Open

potemkin666 with Copilot wants to merge 10 commits into

mainfrom

copilot/refresh-feed-randomize-websites

Commits on Apr 15, 2026

Randomize source selection order within priority tiers on each feed refresh

Copilot
and
potemkin666
authored
Fix XSS, error path leaks, code duplication, missing Playwright exports, confidence bounds

Copilot
and
potemkin666
authored
Cache Date.parse(generatedAt) in nextSourceHealthEntry to avoid 7 redundant parses

Copilot
and
potemkin666
authored
Add SSRF protection: block private/internal IP ranges in URL validation

Copilot
and
potemkin666
authored
Cache geo regex, extract constants to config, add Leaflet defer, remove !important, rename duplicate clean()

Copilot
and
potemkin666
authored
Add form labels for accessibility, fix rate limiter clock skew, extract 404 inline JS

Copilot
and
potemkin666
authored
Fix trigger rate-limit race condition, remove sqlite from git tracking

Copilot
and
potemkin666
authored
Enforce CORS origin checks in all API routes, fix CI race condition, centralize API base URL

Copilot
and
potemkin666
authored
Fix timing leak, hoist country code Map, fix lastBrowserPollAt, strengthen stemming, rename sourceMayAutoCooldown, enhance ESLint

Copilot
and
potemkin666
authored
Merge remote-tracking branch 'origin/main' into copilot/refresh-feed-randomize-websites

Copilot
and
potemkin666
authored