Age	Commit message (Collapse)	Author	Lines
43 hours	Turn down passwords past 256 bytes unchecked	Bryce Kwon	-1/+5
	SHA-crypt hashes the password in most of its rounds, so the 4 KB that cgit's POST limit lets through cost about fifteen ordinary logins per anonymous attempt.
43 hours	Read the auth cookie in linear time	Bryce Kwon	-9/+21
	Splitting the header with patterns that backtrack over spaces cost a quarter of a second per request at the 8 KB line most web servers allow, and a second at 16 KB, without any login. auth-file's trim had the same shape and now reads the cookie as well.
44 hours	Refuse every repository when auth-file loses repos	Bryce Kwon	-11/+14
	A repos file the filter could not open read as listing nothing, so a permission slip or a mistyped path made every protected repository public. A line naming a repository with no groups was skipped the same way, where auth-inline's empty list denies everyone.
2026-09-21	Unify the docs, samples and extensions	Bryce Kwon	-1/+1
2026-09-06	Clean up the whole tree	Bryce Kwon	-22/+11
2026-09-06	Give the login inputs explicit field types	Bryce Kwon	-1/+1
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-44/+29
2026-08-14	Let password managers fill the login form	Bryce Kwon	-4/+4
2026-08-14	Restyle the filter extension headers and markup	Bryce Kwon	-158/+183
2026-08-05	Move the cookie-signing secret out of the cachev2.3.0	Bryce Kwon	-1/+1
2026-08-01	Trim the lua headers and fix the Scintillua notes	Bryce Kwon	-29/+2
2026-08-01	Fix cookie name escaping and stored hash trimming	Bryce Kwon	-2/+16
2026-07-25	Reorganize the tree into vendor/ and custom/	Bryce Kwon	-0/+556