Age	Commit message (Collapse)	Author	Lines
30 hours	Say which hash kinds each system's crypt checks	Bryce Kwon	-2/+13
	The one recipe given, SHA-512 from Debian's mkpasswd, cannot log anyone in on OpenBSD, whose crypt checks only bcrypt, or on macOS, and libxcrypt, which most Linux distributions use, recommends yescrypt instead.
30 hours	Spend a missing account's login on a real hash	Bryce Kwon	-9/+14
	The fixed SHA-512 stand-in matched only the documented setup, so a site hashing with yescrypt, other rounds or bcrypt answered for missing and real names in different times, and on OpenBSD it failed at once.
30 hours	Turn down passwords past 256 bytes unchecked	Bryce Kwon	-1/+5
	SHA-crypt hashes the password in most of its rounds, so the 4 KB that cgit's POST limit lets through cost about fifteen ordinary logins per anonymous attempt.
30 hours	Read the auth cookie in linear time	Bryce Kwon	-5/+21
	Splitting the header with patterns that backtrack over spaces cost a quarter of a second per request at the 8 KB line most web servers allow, and a second at 16 KB, without any login. auth-file's trim had the same shape and now reads the cookie as well.
2026-09-21	Unify the docs, samples and extensions	Bryce Kwon	-1/+1
2026-09-06	Clean up the whole tree	Bryce Kwon	-22/+11
2026-09-06	Give the login inputs explicit field types	Bryce Kwon	-1/+1
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-41/+25
2026-08-14	Let password managers fill the login form	Bryce Kwon	-4/+4
2026-08-14	Restyle the filter extension headers and markup	Bryce Kwon	-138/+158
2026-08-05	Move the cookie-signing secret out of the cachev2.3.0	Bryce Kwon	-1/+1
2026-08-01	Trim the lua headers and fix the Scintillua notes	Bryce Kwon	-30/+3
2026-08-01	Fix cookie name escaping and stored hash trimming	Bryce Kwon	-1/+10
2026-07-25	Reorganize the tree into vendor/ and custom/	Bryce Kwon	-0/+528