Sam Valladares b8de5c9bf7 fix(launch): close waitlist RLS bypass + open email relay + add security headers ... Launch-critical fixes for the public July-14 signup surface (swarm-audited by MiniMax M3, Claude-verified against the frontend RPC call path): - migration: DROP the "anon can insert with check(true)" RLS policy. It let anon write arbitrary rows straight to the table, bypassing all join_waitlist validation. The frontend already calls the join_waitlist RPC (rest/v1/rpc/), never a direct insert, so signup is unaffected. RLS stays enabled with no permissive INSERT policy = direct anon inserts denied by default. - join_waitlist: cap email <=254, reject control chars, truncate referrer <=2048. - waitlist-welcome edge fn: FAIL CLOSED — if WAITLIST_WEBHOOK_SECRET is unset, return 401 instead of serving (was an open Resend relay). Guard the referral code against ^[a-z2-9]{7}$ and cap email length before sending. - vercel.json: add baseline security headers (nosniff, Referrer-Policy, X-Frame-Options: DENY, HSTS, Permissions-Policy). CSP deferred (would break the WebGPU hero's inline bootstrap without nonces) — documented. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-06-27 14:23:58 -05:00
..
index.ts	fix(launch): close waitlist RLS bypass + open email relay + add security headers	2026-06-27 14:23:58 -05:00