Age	Commit message (Collapse)	Author	Lines
38 hours	Say which hash kinds each system's crypt checks	Bryce Kwon	-4/+27
	The one recipe given, SHA-512 from Debian's mkpasswd, cannot log anyone in on OpenBSD, whose crypt checks only bcrypt, or on macOS, and libxcrypt, which most Linux distributions use, recommends yescrypt instead.
39 hours	Spend a missing account's login on a real hash	Bryce Kwon	-21/+31
	The fixed SHA-512 stand-in matched only the documented setup, so a site hashing with yescrypt, other rounds or bcrypt answered for missing and real names in different times, and on OpenBSD it failed at once.
39 hours	Turn down passwords past 256 bytes unchecked	Bryce Kwon	-2/+10
	SHA-crypt hashes the password in most of its rounds, so the 4 KB that cgit's POST limit lets through cost about fifteen ordinary logins per anonymous attempt.
39 hours	Read the auth cookie in linear time	Bryce Kwon	-14/+42
	Splitting the header with patterns that backtrack over spaces cost a quarter of a second per request at the 8 KB line most web servers allow, and a second at 16 KB, without any login. auth-file's trim had the same shape and now reads the cookie as well.
39 hours	Offer avatars at twice the size to dense screens	Bryce Kwon	-14/+22
	The 13 pixel icon came out blurred on the high density screens most phones and laptops have.
39 hours	Hash avatar addresses with SHA-256	Bryce Kwon	-6/+7
	Gravatar's documentation now describes SHA-256 hashes on gravatar.com alone, and Libravatar has long accepted them beside MD5.
39 hours	Mark avatar icons as decorative	Bryce Kwon	-8/+6
	A screen reader announced the service's name before every author.
39 hours	Unwrap an avatar address in linear time	Bryce Kwon	-6/+12
	An author email of 16,000 "<" took three quarters of a second per log row, and one of 64,000 took twelve seconds.
39 hours	Draw no avatar when luaossl is missing	Bryce Kwon	-6/+8
	The require at the top raised as cgit loaded the filter, so every page that lists an author stopped at its first author cell with an error.
39 hours	Drop the table loop's dead blank-line test	Bryce Kwon	-1/+1
	A line holding a pipe is never blank.
39 hours	Add blame to the source filter and line number docs	Bryce Kwon	-6/+6
39 hours	Name every trailer link-trailers.lua links	Bryce Kwon	-3/+3
39 hours	Fix the sample cgitrc's defaults and value syntax	Bryce Kwon	-13/+16
39 hours	Describe root-readme as the site's about page	Bryce Kwon	-5/+5
39 hours	Name the log link that enable-index-links adds	Bryce Kwon	-1/+1
	The manual has named the commit page since it was written in 2008, a year after the index started linking the log instead.
39 hours	Give readme headings anchors like GitHub's	Bryce Kwon	-1/+36
	A readme's links to its own sections, as in a table of contents, had nothing on the page to land on.
39 hours	Keep underscores inside words out of emphasis	Bryce Kwon	-4/+9
39 hours	Let character references through to the browser	Bryce Kwon	-2/+17
	Decoding them here instead would mean carrying every named reference HTML defines, while the browser already knows them all.
39 hours	Honour backslash escapes in readmes	Bryce Kwon	-1/+3
39 hours	Link the urls and addresses in angle brackets	Bryce Kwon	-1/+18
39 hours	Keep a wrapped list item in its list	Bryce Kwon	-8/+20
	The item's second line became a paragraph of its own and the items after it a new list, so an ordered list started counting again.
39 hours	Let a table cut a paragraph short	Bryce Kwon	-2/+15
	A table written right under a line of text came out as more of the paragraph, pipes and all.
39 hours	Run a paragraph's lines together like GitHub	Bryce Kwon	-10/+33
	GitHub shows a single newline in a markdown file as a space, and roff fills the lines of a man page the same way, so text wrapped in the source came out ragged on the about page.
39 hours	Leave images and badges out of rendered readmes	Bryce Kwon	-21/+28
	A relative image loaded from below the about page, which answers 404 now, and a remote one had every visitor's browser call a third party. A badge also came out as a link to its own image, wrapped in stray brackets.
39 hours	Lead a readme's relative links into the tree	Bryce Kwon	-6/+55
	A browser resolved them against the about page, where nothing lives now that the page answers 404 below itself. They resolve the way GitHub resolves a readme's links instead, from the readme's directory and on the branch it was read from.
39 hours	Trim readme lines in linear time	Bryce Kwon	-2/+26
	The heading pattern backtracked over a run of spaces in cubic time and the cell trim in quadratic time, so one crafted line in a readme could hold a request for half an hour, well inside the size cap. The heading rule now also keeps a sharp that ends a word, as in "# C#".
39 hours	Keep the age hook's directory group writable	Bryce Kwon	-2/+11
	The hook forced a 022 umask, so in a repository shared with a group the first pusher owned info/web and every other member's push failed to write the age file there.
39 hours	Keep the cache hook's rm errors from pushers	Bryce Kwon	-4/+4
	Only the exit status was hidden, so a pusher without write access to the cache root saw a permission error per cached page, against what the hook's own comment promised.
39 hours	Trim avatar addresses in linear time	Bryce Kwon	-2/+30
	The trim pattern backtracked over a run of spaces inside an address, which a commit can carry, and a log page runs the filter for every row. Forty thousand spaces took two seconds per row.
39 hours	Refuse every repository when auth-file loses repos	Bryce Kwon	-11/+14
	A repos file the filter could not open read as listing nothing, so a permission slip or a mistyped path made every protected repository public. A line naming a repository with no groups was skipped the same way, where auth-inline's empty list denies everyone.
2026-10-01	Mark a page behind an auth filter private	Bryce Kwon	-14/+15
	Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in.
2026-10-01	Keep clone files and oversized responses out of the cache	Bryce Kwon	-0/+5
	The dumb transport reads files that already sit on the disk, so a pack copied into a slot cost that disk twice and the request a second write of every byte. A snapshot took a slot whatever its size, so a visitor naming distinct refs and ids could fill the cache root with archives. `cache-max-slot-size`, 64 MB unless set, now serves a larger response from the lock file and drops it, along with any expired copy it would have replaced.
2026-10-01	Gate html serving behind trust-scan-config	Bryce Kwon	-3/+3
	`enable-html-serving` makes the plain page send a repository file as text/html on the site's own origin, with no nosniff and no policy, so a scanned repository could switch it on from its git config or cgitrc without `trust-scan-config` and run script against every visitor. The warning for a key read from git config also named a null repository, because `repo->path` was set only after that file had been read.
2026-09-27	Rename enable-trailers to enable-commit-trailers	Bryce Kwon	-11/+12
2026-09-21	Unify the docs, samples and extensions	Bryce Kwon	-207/+236
2026-09-21	Harden the request path, scan and error recovery	Bryce Kwon	-6/+6
2026-09-15	Gate scanned filters with `trust-scan-filters`	Bryce Kwon	-18/+16
2026-09-15	Apply the mailmap at HEAD to every ident	Bryce Kwon	-0/+9
2026-09-15	Add the link-trailers extension	Bryce Kwon	-0/+109
2026-09-15	Split trailers out of the commit message	Bryce Kwon	-0/+19
2026-09-06	Clean up the whole tree	Bryce Kwon	-84/+43
2026-09-06	Give the login inputs explicit field types	Bryce Kwon	-2/+2
2026-09-06	Refresh the server configs and drop `unsafe-inline`	Bryce Kwon	-94/+71
	The inline handlers and the auto-submitting selects are gone, so `script-src` no longer needs it, and t0004 now checks that the three configs pin the same policy.
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-297/+203
2026-09-06	Rename the inconsistent config keys	Bryce Kwon	-120/+129
	noplainemail enable-plain-email noheader enable-header cache-root-ttl cache-index-ttl cache-repo-ttl cache-summary-ttl cache-scanrc-ttl cache-scan-ttl agefile age-file renamelimit rename-limit extra-head-content head-content
2026-08-27	Remove the language breakdown from the stats page	Bryce Kwon	-2/+2
2026-08-27	Replace `nbsp` spacing with CSS	Bryce Kwon	-4/+4
2026-08-23	Document cache directory ownership	Bryce Kwon	-1/+3
2026-08-23	Refuse unknown and spoofed hostnames in nginx.conf	Bryce Kwon	-0/+31
2026-08-18	Rework the response headers in the server configs	Bryce Kwon	-30/+132