AHMED
0161924088
Free early-access launch: LAUNCH_MODE policy, CRO, pipeline hardening, AI-SEO, ops
...
- launch.ts policy: LAUNCH_MODE=free_early_access default; effective access =
published && (free || early); intended tier (access) never rewritten
- Billing off server-side: /api/subscribe 503 honest copy; subscribe CTAs
render disabled 'قريباً' from first paint; /subscription early-access panel
+ /api/notify (LaunchNotifications) with honest 503 when mail transport off
- Signup trust: verification email at signup (Users afterChange), no
confirm-password, 429 message fidelity, typo suggestion, live password hint
- Agent pipeline: pickFields strips access/readingMinutes, sourceId dedup,
secret-scan 422 (pattern names only), string-content rejected (was silently
replaced), publish stays explicit opt-in
- lexical.ts: root unwrap fix — lexicalToText/countLexicalWords returned 0
for real serialized trees (secret scan + readingMinutes were inert)
- llms-full.txt: fetchIndexDocs(true) — bodies were never selected
- Content honesty: contentType/authorName/sourceId fields + migration,
readingMinutes computed at write (160 wpm) + backfill script, byline,
'حُدّث' freshness
- SEO/AI-SEO: metadata rewrite (published-only, og:image 1200x630), Article +
BreadcrumbList + FAQPage + Organization JSON-LD, isAccessibleForFree honest,
table renderer, robots AI-crawler policy (10 named bots), llms.txt +
llms-full.txt, /topics/* hubs + sitemap, noindex auth pages, www 301
- Ops: backup-db.sh (restore rehearsed on VPS), docs copies (launch
readiness + marketing audit + owner-inputs for L-03), GLOSSARY.md entries
Verified: tsc --noEmit 0, npm run build 0, local smoke (ghost VIP read,
subscribe/notify/agent APIs, signup token, 429 on 6th, llms/topics/sitemap,
og:image/JSON-LD)
2026-10-10 18:03:45 +03:00
AHMED
8e577165cf
Security fixes from pentest 2026-10-09 (F1, F2, F4, F7)
...
- F2: per-IP rate limits on POST /api/users, /login, /forgot-password
via new Next middleware (5/h signup, 10/15min login, 5/h forgot);
429 + Retry-After, generic Arabic error, no UX change
- F7: ghost-email logins burn the same PBKDF2 cost (600k/32/sha256)
as real verifies, closing response-time user enumeration
- F4: HSTS max-age=63072000; includeSubDomains on all routes
- F1: Traefik pagelimit (60/min, burst 120) + connlimit (in-flight 50)
on the page router; apilimit untouched
- Pentester accounts (ids 42-48) deleted in prod DB
2026-10-09 17:00:15 +03:00
AHMED