2 commits

Author	SHA1	Message	Date
Sam Valladares	b8de5c9bf7	fix(launch): close waitlist RLS bypass + open email relay + add security headers ... Launch-critical fixes for the public July-14 signup surface (swarm-audited by MiniMax M3, Claude-verified against the frontend RPC call path): - migration: DROP the "anon can insert with check(true)" RLS policy. It let anon write arbitrary rows straight to the table, bypassing all join_waitlist validation. The frontend already calls the join_waitlist RPC (rest/v1/rpc/), never a direct insert, so signup is unaffected. RLS stays enabled with no permissive INSERT policy = direct anon inserts denied by default. - join_waitlist: cap email <=254, reject control chars, truncate referrer <=2048. - waitlist-welcome edge fn: FAIL CLOSED — if WAITLIST_WEBHOOK_SECRET is unset, return 401 instead of serving (was an open Resend relay). Guard the referral code against ^[a-z2-9]{7}$ and cap email length before sending. - vercel.json: add baseline security headers (nosniff, Referrer-Policy, X-Frame-Options: DENY, HSTS, Permissions-Policy). CSP deferred (would break the WebGPU hero's inline bootstrap without nonces) — documented. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-27 14:23:58 -05:00
Sam Valladares	6837198328	feat(launch): waitlist page, raw-WebGPU hero, supabase + vercel infra ... The July 14 launch surface, previously uncommitted: - /dashboard/launch raw-WebGPU particle "memory brain" hero (RawVestigeEngine, NeuralWordmark, dendrite sign) + DOM waitlist overlay with share/referral. - Supabase waitlist client + migrations + welcome edge function; legacy waitlist archived under supabase/legacy. - vercel.json deploy config, root-redirect env wiring, base-path config, graph-only route, Playwright launch verifiers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-27 11:13:02 -05:00