security-auditor 5b7b669b4c docs(ratelimit): tighten dev-mode comment after keyFor refactor ...

The previous comment said "all share one IP bucket" — accurate before
the keyFor refactor, slightly stale after it. The dev-mode rationale
(bucket fills fast, blanks the page on a single-user dev box) is
unchanged; only the bucket-key flavour text needed updating.

Doc-only follow-up from #60's hostile self-review #3. No behavior change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-07 14:57:21 -07:00

..

devmode_test.go

refactor(middleware): extract dev-mode fail-open predicate

2026-04-23 14:55:34 -07:00

devmode.go

fix: six UX bugs (peers auth, scroll, chat tabs, config persist, + visibility)

2026-04-23 20:18:30 -07:00

mcp_ratelimit_test.go

chore: open-source restructure — rename dirs, remove internal files, scrub secrets

2026-04-18 00:24:44 -07:00

mcp_ratelimit.go

chore: open-source restructure — rename dirs, remove internal files, scrub secrets

2026-04-18 00:24:44 -07:00

ratelimit_keyfor_test.go

fix(ratelimit): tenant-aware bucket keying — close canvas 429 storm

2026-05-07 14:51:08 -07:00

ratelimit_test.go

chore: open-source restructure — rename dirs, remove internal files, scrub secrets

2026-04-18 00:24:44 -07:00

ratelimit.go

docs(ratelimit): tighten dev-mode comment after keyFor refactor

2026-05-07 14:57:21 -07:00

securityheaders_test.go

chore: open-source restructure — rename dirs, remove internal files, scrub secrets

2026-04-18 00:24:44 -07:00

securityheaders.go

chore: open-source restructure — rename dirs, remove internal files, scrub secrets

2026-04-18 00:24:44 -07:00

session_auth_test.go

fix(canvas/a11y): restore aria-hidden on backdrop div after cherry-pick conflict

2026-04-24 03:10:18 +00:00

session_auth.go

fix(canvas/a11y): aria-hidden SVGs, MissingKeysModal dialog, session cookie auth

2026-04-24 04:30:26 +00:00

tenant_guard_test.go

fix(tenant-guard): allowlist /buildinfo so redeploy verifier can reach it

2026-04-30 12:54:51 -07:00

tenant_guard.go

fix(tenant-guard): allowlist /buildinfo so redeploy verifier can reach it

2026-04-30 12:54:51 -07:00

wsauth_middleware_canvasorbearer_test.go

refactor(wsauth): extract lookupTokenByHash to dedup auth predicate across 3 callers

2026-04-30 03:11:38 -07:00

wsauth_middleware_org_id_test.go

test(middleware): add last_used_at ExpectExec for WorkspaceAuth org-token tests

2026-04-24 13:01:42 +00:00

wsauth_middleware_test.go

refactor(wsauth): extract lookupTokenByHash to dedup auth predicate across 3 callers

2026-04-30 03:11:38 -07:00

wsauth_middleware.go

feat(platform,canvas): classify "datastore unavailable" as 503 + dedicated UI

2026-04-26 00:01:56 -07:00