Age	Commit message (Collapse)	Author	Lines
9 days	Mark a page behind an auth filter private	Bryce Kwon	-0/+22
	Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in.
9 days	End a request quietly when the client has gone	Bryce Kwon	-0/+16
	A write that failed with EPIPE on an uncached page died into an error page, which died again at exit when the page could not be sent either, and git logged a recursion warning on every dropped connection. A filter that exits early fails a write the same way, so the quiet exit is kept for writes that reach the client itself.
9 days	Leave a branch spelled like an option out of the switcher	Bryce Kwon	-0/+7
	Such a name is refused as a head before git could read it as an option, and the fallback branch already skips it, so the switcher offered a choice that led only to an error page.
9 days	Walk a path on the blob page from any commit the id names	Bryce Kwon	-0/+15
	With both an id and a path the blob page handed back the raw object the id named, so a commit id gave the commit text itself, while the plain page looked the path up in that commit's tree. A tag is peeled to its commit on the way, and the README example of a pinned commit now uses a form the request checks accept.
9 days	Keep the query string across the about redirects	Bryce Kwon	-0/+13
	The hop to the trailing-slash form of the about page, and the hop back to the summary of a repository without a readme, were built from the path alone, so a request for the about page of another branch landed on the default one. The query goes into the Location line as the client sent it, with any byte a header cannot carry percent-encoded.
9 days	Withhold the alternates file on the dumb transport	Bryce Kwon	-0/+13
	It lists object directories by their path on the server, which a client fetching over http can neither use nor needs to learn. The http-alternates file written for such clients still goes out.
9 days	Send a clone file with its size in whole batches	Bryce Kwon	-0/+15
	The dumb transport read a pack four kilobytes at a time through stdio and sent it without a length, so a client could not tell a cut-off transfer from a complete one.
9 days	Gate html serving behind trust-scan-config	Bryce Kwon	-3/+39
	`enable-html-serving` makes the plain page send a repository file as text/html on the site's own origin, with no nosniff and no policy, so a scanned repository could switch it on from its git config or cgitrc without `trust-scan-config` and run script against every visitor. The warning for a key read from git config also named a null repository, because `repo->path` was set only after that file had been read.
13 days	Rename enable-trailers to enable-commit-trailers	Bryce Kwon	-1/+1
2026-09-21	Test the hardening pass	Bryce Kwon	-0/+471