feat(journal/ventures): ADS security hardening batch — 10 Jul 2026

[ParagonJenko]

Summary

Catches up the public-facing journal and ADS venture page with the security hardening batch merged into adopt-dont-shop on 10 Jul 2026 (PRs #1199–#1203).

Journal (journal/index.html)

• New entry dated 10 Jul 2026 at the top of the log covering the five changes shipped that day, written in customer-facing language per the journal's operating principles

ADS venture page (ventures/adopt-dont-shop/index.html)

• Extended the "Shipped in the alpha" paragraph to include the 10 Jul hardening batch: per-email login rate limiting, XFF trust hardening, encrypted-at-rest production backups, WebSocket connection capping, container/CI hardening, and the event attendance accuracy fix

What shipped on 10 Jul (source: GitHub)

• ADS-935 — Rescue event attendance rates fixed (was always 0% from a stale column; now live from check-in counts)
• ADS-915 — XFF trust hardening: gateway now trusts only its direct upstream proxy, closing IP-spoofing around rate limits
• ADS-916 — Per-email login rate limiting layered on top of existing per-IP cap
• ADS-920/929 — Production S3 backups now use SSE-AES256; CI workflow permissions tightened to least-privilege
• ADS-888 — WebSocket connections capped per user (10 per replica) to prevent credential-abuse amplification
• ADS-924/925/932/933/881 — Container hardening: read-only nginx filesystems, Grafana anonymous role downgraded to Viewer, dev /metrics denied, Redis secret written 0600, dev base image pinned by digest

No Pairflix changes to log (no commits in the last 24 h).

---

Generated by Claude Code

[netlify]

✅ Deploy Preview for ideasquared ready!

Name	Link
🔨 Latest commit	0772f5c
🔍 Latest deploy log	https://app.netlify.com/projects/ideasquared/deploys/6a52c104877ad00008512a2a
😎 Deploy Preview	https://deploy-preview-41--ideasquared.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.