Lucas WintherandClaude Opus 5.5 baa3476b73 fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host ...

From the final review: proxied archived HTML could run on our origin and read a
remembered token; /api/upload accepted any Wayback URL and GIF-prefixed bytes; the
origin check broke behind a TLS proxy; one unreadable snapshot could fail a run.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-15 01:49:52 +02:00

..

plans

docs: implementation plan 001 (draft, awaiting approval)

2026-10-14 23:31:20 +02:00

specs

docs: amend spec 001 from tests against real Webtoons, Wayback and MangaBaka

2026-10-14 23:03:15 +02:00

ARCHITECTURE.md

fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host

2026-10-15 01:49:52 +02:00

DECISIONS.md

fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host

2026-10-15 01:49:52 +02:00

PERMISSIONS.md

feat(userscript): Seed covers panel on MangaBaka series pages

2026-10-15 01:40:04 +02:00

TODO.md

fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host

2026-10-15 01:49:52 +02:00