Non-blocking findings from the #179 security review, filed per master merge flow:
src/lib/cf/oauth-server.ts getRequestOrigin trusts x-forwarded-host/x-forwarded-proto unconditionally. Safe on Vercel (headers set by the platform; CF also rejects unregistered redirect_uris), but add a comment documenting the trust assumption.src/app/api/cf/oauth/callback/route.ts signed-out-on-callback returns raw 401 JSON and does not clear the state cookie — redirect to sign-in (same-origin) and delete the cookie instead. UX only.- Dead contract/schema cleanup after OIDC migration:
handle_verifications table (schema + drop migration), hasCompileErrorSince(), CfVerifyStartResponse/CfLinkResponse in types.ts. Explicitly a schema/contract issue.
Non-blocking findings from the #179 security review, filed per master merge flow:
src/lib/cf/oauth-server.tsgetRequestOrigintrustsx-forwarded-host/x-forwarded-protounconditionally. Safe on Vercel (headers set by the platform; CF also rejects unregistered redirect_uris), but add a comment documenting the trust assumption.src/app/api/cf/oauth/callback/route.tssigned-out-on-callback returns raw 401 JSON and does not clear the state cookie — redirect to sign-in (same-origin) and delete the cookie instead. UX only.handle_verificationstable (schema + drop migration),hasCompileErrorSince(),CfVerifyStartResponse/CfLinkResponseintypes.ts. Explicitly a schema/contract issue.