Mike Dalessio d28ab55bf4 Document the self-hosted trust model in SECURITY.md (#230) ...

Nothing in the repository records that unrestricted bot webhook delivery is
deliberate, so the missing private-network guard reads as an oversight next to
the guarded unfurl path. Researchers report it as server-side request forgery,
repeatedly.

2026-07-31 13:09:59 -04:00

..

assets

Show admin toggle, but disable for current user

2025-12-08 22:53:11 -06:00

channels

Hello world

2025-08-21 09:31:59 +01:00

controllers

Disable libvips unfuzzed operations (#226)

2026-07-28 11:57:57 -04:00

helpers

Rework toggle as switch

2025-12-01 23:13:54 -06:00

javascript

[Logout localhost fix] - fixing an error for logout process on localhost.

2025-10-06 15:14:23 +02:00

jobs

Add IP-based user banning

2025-11-26 14:30:38 +00:00

models

Document the self-hosted trust model in SECURITY.md (#230)

2026-07-31 13:09:59 -04:00

views

Ensure edit (not trash) is displayed

2025-12-08 22:57:38 -06:00