jelveh 62ce691ac9 Stop user-hosted sites from framing the toolbar and app browser embeds ...

frame-ancestors allowed every *.<domain> subdomain, which on the default
self-hosted layout includes user sites (*.site.<domain>) and private apps
(*.app.<domain>), letting any hosted page clickjack sign-out and account
switching. The policy now names the embedding page exactly, from the
request's referrer, and refuses the user-content hosting domains.

2026-10-01 22:26:03 -07:00

..

i18n

Revise bug report and feature request instructions (#3220)

2026-06-18 09:27:55 -07:00

alarms.md

fix(ai): keep per-provider failures when every chat route fails (#3836)

2026-09-09 14:56:11 -07:00

architecture.md

fix: hardening (#3904)

2026-09-18 11:22:39 -07:00

contributing-apis.md

feat: a paid plan counts as a verified card for the sharing gate (#3886)

2026-09-16 10:18:47 -07:00

embedding-app-browser.md

Stop user-hosted sites from framing the toolbar and app browser embeds

2026-10-01 22:26:03 -07:00

license_header.txt

Remove gross legacy tools and docs (#2873)

2026-05-01 12:58:36 -07:00

pagination.md

feat: standardized api pagination (#3412)

2026-07-20 15:58:23 -07:00

self-hosting.md

self hosted mail (#3932)

2026-09-25 21:48:15 -04:00