Age	Commit message (Collapse)	Author	Lines
2026-10-14	Serve only the files a dumb clone asks for	Bryce Kwon	-2/+2
	The object path check let any run of safe characters through, so a spelling such as info//alternates or info/./alternates reached the alternates file the exact name was refused for.
2026-10-03	Describe root-readme as the site's about page	Bryce Kwon	-0/+16
2026-09-29	Answer 404 for any path below the about page	Bryce Kwon	-1/+1
	The about page served every file beside the readme as a page of its own, through the about filter, and answered 200 for directories and missing files alike. Images it passed through came from the root of the default branch whatever the readme's own directory and ref. A readme on disk exposed its whole directory this way.
2026-09-24	Test the advisory classes and name an empty author	Bryce Kwon	-0/+110
	Each class behind cgit's published advisories now has a check against the current code, from a newline in a file name to shell syntax handed to a filter. The feed also treated an ident with an empty name and an empty address as present and wrote an empty person, which Atom forbids.
2026-09-15	Test the hardening pass	Bryce Kwon	-1/+1
2026-09-14	Harden the request path, scan and error recovery	Bryce Kwon	-5/+26
2026-09-07	Clean up the whole tree	Bryce Kwon	-2/+1
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-4/+2
2026-09-06	Remove the auto-submitting selects	Bryce Kwon	-4/+4
2026-08-23	Renumber the test scripts into themed ranges	Bryce Kwon	-0/+0
	The numbering walks outward from the ground the suite stands on. - t000x for the git version, html validity and the cache - t01xx for page content, one script per page - t02xx for filters, submodule links, dates and limits, which cut across pages - t03xx for defence, the security regressions and the $HOME promise - t04xx for the helper tools under tools/