Grouped low-severity findings in apps/user-application.
parseAcceptLanguage ignores RFC q=0 and uppercase Q= — lib/parse-accept-language.ts:14-23. en;q=0 returns "en" (should be default); pl;Q=0.2,en;q=0.9 returns "pl". Tests: both cases.- Turnstile test-sitekey fallback masks prod misconfig —
routes/index.tsx:13,47-48. Missing VITE_TURNSTILE_SITE_KEY in a prod build silently renders the always-pass test widget; siteverify response hostname is unchecked (stage tokens valid for prod). Test: loader throws when key missing in PROD.
checkSession/requireSession return the full session (incl. session.token) over the wire — core/functions/session.ts:10-33. JS-readable; an XSS gains a token it could not otherwise read. Return {user} only.- Theme anti-FOUC script runs in
useEffect (post-hydration) — components/.../theme-provider.tsx:147-173. Cannot prevent the dark-mode flash; emit it in <head> via the root head().
detectInitialLanguage is called per client navigation — __root.tsx:22-25. An HTTP round trip each navigation for a value that cannot change mid-session.- Stale detail-key cache invalidation —
components/sources/source-form.tsx:232-238. Update invalidates ["notification-sources"] but not ["notification-source", id]; re-entering Edit within the preload window shows pre-edit data.
Grouped low-severity findings in
apps/user-application.parseAcceptLanguageignores RFC q=0 and uppercaseQ=—lib/parse-accept-language.ts:14-23.en;q=0returns "en" (should be default);pl;Q=0.2,en;q=0.9returns "pl". Tests: both cases.routes/index.tsx:13,47-48. MissingVITE_TURNSTILE_SITE_KEYin a prod build silently renders the always-pass test widget; siteverify responsehostnameis unchecked (stage tokens valid for prod). Test: loader throws when key missing in PROD.checkSession/requireSessionreturn the full session (incl.session.token) over the wire —core/functions/session.ts:10-33. JS-readable; an XSS gains a token it could not otherwise read. Return{user}only.useEffect(post-hydration) —components/.../theme-provider.tsx:147-173. Cannot prevent the dark-mode flash; emit it in<head>via the roothead().detectInitialLanguageis called per client navigation —__root.tsx:22-25. An HTTP round trip each navigation for a value that cannot change mid-session.components/sources/source-form.tsx:232-238. Update invalidates["notification-sources"]but not["notification-source", id]; re-entering Edit within the preload window shows pre-edit data.