Security: code-only password reset, evidence-first site, and production hardening - #302
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
Brings #300..#306 onto this branch and resolves the two conflicts, both on the homepage stat row. Both sides rewrote the SAME tile: this branch replaced the Netskope figure with "2 / deployment paths", while main (#301) kept the figure and corrected its denominator. The grid is a hard `repeat(4, 1fr)` (app/hermes.css:263), so a fifth tile orphans on its own row — it is genuinely one or the other, not a merge both sides can win. Resolved to main's tile, because keeping it loses nothing. <ModeBNotice> renders IMMEDIATELY below this row and already states both deployment paths with the honesty the NEVER-DO list requires: "CUI-safe = Mode B (Docker on your infrastructure); the hosted trial runs on Vercel and is not FedRAMP-authorized." The deployment distinction therefore survives in a richer form, and it is still asserted by the Mode-B notice test. The Netskope figure has no second home on the page, and it is the market proof for the fastest-closing buyer. The matching test conflict is resolved the same way: the tile assertions follow the source, and the branch's `not.toContain('~80,000')` guard against unverifiable statistics is kept. Gates on the merged tree: tsc 0 · eslint 0 errors (35 pre-existing warnings) · 2970/2970 tests pass in 211 files · production build clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Ugr8hJemeERsbKeTryM5Q
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release scope
This PR promotes validated P0/P1 security remediation and product-readiness improvements from commit
44e8e1d.Authentication hardening
Database migrations
035_password_reset_codes.sql: HMAC-hashed, expiring, single-use password-reset codes.036_revoke_public_security_definer.sql: removes public execution of privileged RPCs.Both migrations have been applied and verified in production Supabase project
qifynzuyrdxmxlumpsrq.Product and dashboard updates
Validation
Required production gates before promotion
AUTH_RESET_CODE_PEPPERin Vercel.TURNSTILE_SECRET_KEYandNEXT_PUBLIC_TURNSTILE_SITE_KEYin Vercel.CRON_SECRETunset until email and outreach controls are verified.Closes the audit P0/P1 remediation scope.