Harden API write and RPC authorization boundaries - #153

Open

LuisUrrutia wants to merge 14 commits into

LuisUrrutia:luisurrutia/security-harden-api

Commits on Aug 27, 2026

fix(security): enforce server-validated API boundaries
LuisUrrutia
committed
92ca97b
fix(search): preserve underscores in usernames
LuisUrrutia
committed
bb114aa
fix(posts): enforce server-side deletion
LuisUrrutia
committed
6928145
fix(cli): return 503 when identity checks fail
LuisUrrutia
committed
a24c95e
fix(types): allow redacted daily usage rows
LuisUrrutia
committed
05fdeee
docs(changelog): describe complete API hardening behavior
LuisUrrutia
committed
91848ee
test(cli): preserve identity errors in flow mocks
LuisUrrutia
committed
0bc0765
fix(streaks): isolate inaccessible batch entries
LuisUrrutia
committed
999245b
test(migrations): track column-level user grants
LuisUrrutia
committed
a96473e
fix(upload): match post image storage limits
LuisUrrutia
committed
d991ce3
fix(upload): validate converted image payloads
LuisUrrutia
committed
1c79239
fix(search): preserve punctuation in user searches
LuisUrrutia
committed
e45c55b
fix(profile): normalize empty timezones to UTC
LuisUrrutia
committed
13f9915
fix(search): reject PostgREST wildcard aliases
LuisUrrutia
committed
5be95ea