cinny

LotusGuild/cinny

Fork 0

Files

T

History

Lotus CIandClaude Opus 5.5 2c11bd3b8e

CI / Build & Quality Checks (pull_request) Successful in 4m30s

Details

CI / Trigger Desktop Build (pull_request) Skipped

Details

CI / Docker image build & smoke test (pull_request) Skipped

Details

CI / Secret scan (gitleaks) (pull_request) Successful in 15s

Details

CI / Playwright smoke (e2e) (pull_request) Successful in 17m17s

Details

fix(previews): a page can no longer pose as a YouTube (etc.) player via its og:url (#326 )

The embed fallback used the preview's og:url whatever site was posted.
og:url is set by the page, so evil.example could render as a playable
YouTube card (attacker's video) whose links go to evil.example. Only use
an og:url on the same provider as the posted link, including the
provider's own short-link domains (youtu.be, spotify.link, redd.it, …).

Fixes #326

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

2026-10-17 23:54:50 -04:00

app

fix(previews): a page can no longer pose as a YouTube (etc.) player via its og:url (#326 )

2026-10-17 23:54:50 -04:00

client

fix(startup): Firefox no longer hangs on "Heating up" after login (#303 )

2026-10-16 21:31:55 -04:00

types

feat(settings): sync preferences across devices via io.lotus.settings account data (#104 )

2026-09-17 01:56:06 -04:00

util

fix: ESLint errors, stale disable comments, bundle splitting