Open Graph/Twitter social preview & SECURITY.md - #47
Conversation
Shared links (LinkedIn, Slack, Twitter/X, email) had no image or description card — just a bare URL. Adds og:*/twitter:* meta tags plus a hero image generated from the live demo dashboard (262/262 owned tasks, 98% launch ready) instead of a static logo, and wires the image into the production build's copy step so it ships at /og-image.png. The og:image/og:url values are placeholder (your-deployment-url.vercel.app) until the app is actually deployed — same pattern as the two (#) demo links already in README.md. Needs a follow-up edit once the real URL exists. Also hardens the InlineConfigForFileProtocolPlugin added in the previous commit: it now throws during the build if index.html's script tag doesn't match what it expects to replace, instead of silently no-op'ing and shipping a dist/ build that's still broken under file://.
No security policy existed, which is a gap for a public POC — nothing told a researcher how to report an issue privately rather than opening a public GitHub issue. Points to GitHub's private vulnerability reporting, and summarizes the two distinct security models already documented in more depth elsewhere (client-only localStorage app; self-hosted sync server's scrypt/HTTPS notes in server/README.md) instead of duplicating them.
hypnoticdata777
left a comment
hypnoticdata777
left a comment
There was a problem hiding this comment.
22c6bab — Open Graph/Twitter social preview: Shared links now show a real card (title, description, and a hero image pulled from the live demo dashboard — 262/262 owned tasks, 98% launch ready — instead of a bare URL). Also hardened the file:// build plugin so it throws a build error instead of silently shipping a broken bundle if index.html's script tag ever changes.
3951b55 — SECURITY.md: Points researchers to GitHub's private vulnerability reporting instead of a public issue, and summarizes the two security models (client-only localStorage app vs. the self-hosted sync server) without duplicating the deeper detail already in server/README.md.
One thing waiting on you: the OG tags in index.html (lines with og:image, og:url, twitter:image) currently point at a placeholder https://your-deployment-url.vercel.app — same as the two (#) links in the README. Once Vercel gives you the real URL, send it over and I'll do one pass updating all of them together.
hypnoticdata777
left a comment
hypnoticdata777
left a comment
There was a problem hiding this comment.
22c6bab — Open Graph/Twitter social preview: Shared links now show a real card (title, description, and a hero image pulled from the live demo dashboard — 262/262 owned tasks, 98% launch ready — instead of a bare URL). Also hardened the file:// build plugin so it throws a build error instead of silently shipping a broken bundle if index.html's script tag ever changes.
3951b55 — SECURITY.md: Points researchers to GitHub's private vulnerability reporting instead of a public issue, and summarizes the two security models (client-only localStorage app vs. the self-hosted sync server) without duplicating the deeper detail already in server/README.md.
One thing waiting on you: the OG tags in index.html (lines with og:image, og:url, twitter:image) currently point at a placeholder https://your-deployment-url.vercel.app — same as the two (#) links in the README. Once Vercel gives you the real URL, send it over and I'll do one pass updating all of them together.
2 participants
No description provided.