Repository navigation

fix: privacy and security gaps from post-merge review (#44) - #47

Merged

ucguy4u merged 20 commits into

mainfrom

cursor/privacy-security-gaps-9d97

Nov 3, 2026

Merged

fix: privacy and security gaps from post-merge review (#44)#47
ucguy4u merged 20 commits into
mainfrom
cursor/privacy-security-gaps-9d97

Commits on Nov 2, 2026
- fix(B1): opt-in cloud backup with filtered Supabase payload
  
  cursoragent
  and
  ucguy4u
  committed
  925d2ea
- fix(B3): configure RevenueCat only when Store tab is active
  
  cursoragent
  and
  ucguy4u
  committed
  e21d520
- fix(B4): bundle fonts and use local theme typography
  
  cursoragent
  and
  ucguy4u
  committed
  260e17f
- fix(B5): optional encounter share payload with documented fields
  
  cursoragent
  and
  ucguy4u
  committed
  19c821e
- fix: secure storage for tokens and disable Android Auto Backup
  
  cursoragent
  and
  ucguy4u
  committed
  4f67056
- fix: webhook constant-time auth and RevenueCat HMAC verification
  
  cursoragent
  and
  ucguy4u
  committed
  3cc91d2
- docs: TODOS note for legal pass after privacy fixes
  
  cursoragent
  and
  ucguy4u
  committed
  343e247
- fix(worker): fail closed on webhook auth and sign raw body bytes
  
  cursoragent
  and
  ucguy4u
  committed
  d2a22ed
- fix(app): skip legacy migration when empty and guard startup
  
  cursoragent
  and
  ucguy4u
  committed
  e112029
- fix(app): delete cloud backup on revoke with owner DELETE policy
  
  cursoragent
  and
  ucguy4u
  committed
  c3435f1
- test: HTTP backup gates, migration, worker fetch, and share defaults
  
  cursoragent
  and
  ucguy4u
  committed
  4d85296
- chore: remove unused import in backup HTTP test
  
  cursoragent
  and
  ucguy4u
  committed
  3f07a65
- test(worker): assert constantTimeEqual rejects length mismatch
  
  cursoragent
  and
  ucguy4u
  committed
  233a1f3
Commits on Nov 3, 2026
- test: close consent, R3, W11 gaps for architect review
  
  cursoragent
  and
  ucguy4u
  committed
  10dd0f5
- fix: satisfy flutter analyze on new tests
  
  cursoragent
  and
  ucguy4u
  committed
  3d9a8b9
- fix(backup): require DELETE rows; harden session refresh and tests
  
  cursoragent
  and
  ucguy4u
  committed
  19b6047
- ci(worker): npm ci before tsc --noEmit
  
  cursoragent
  and
  ucguy4u
  committed
  afa03a1
- test: kill R3b/N7/N8/N10 survivors; defer Store mount at launch
  
  cursoragent
  and
  ucguy4u
  committed
  fbfe6e2
- fix(backup): treat 400 refresh as auth failure; idempotent revoke
  
  cursoragent
  and
  ucguy4u
  committed
  969ca4c
- fix(backup): session-owner revoke guard and PA survivor tests
  
  cursoragent
  and
  ucguy4u
  committed
  4e00853

Commits

Commits on Nov 2, 2026

Commits on Nov 3, 2026