Devlog #11

I found that browsers automatically remove tabs and newlines from a URL before checking its scheme, whereas my regex did not, and hence, I missed that javascript URLs could still bypass the sanitization and that is why they still worked. It ended up being part of releases 1.1.0 and 1.2.0.

Also, I discovered that when checking whether environment leakage exists (build command is “x build”), this check silently fails without any message if environment is indeed leaky secrets get masked properly but “x build” exits with 0 and therefore CI never discovers that a feature has quietly malfunctioned.

This time, the patches for both of these issues have been made properly and checked manually before merging.

Roadmap backlog has been taken care of after that. The items are a real end-to-end RBAC example, Redis multi-replica soak test, which would stress the multi-db system in a very large-scale environment; and a time when the security disclosure SLA is truly acted out in real life scenario not just being a paper trail.