- Rate limits in the shared cache for comments, issues, uploads and
invites; a limited HTMX reply keeps the draft.
- Content-Security-Policy (self only, no inline script or style, bucket
origin for images and frames) and Permissions-Policy on every page.
htmx configured not to inject styles or eval.
- Moderation: deactivating a user ends their sessions and keeps their
content; deleted accounts show as "ghost"; reserved usernames; the
admin won't delete an org's last owner.
- Admin requires a TOTP code (django-otp), with add_admin_totp to enrol.
- Email provider chosen by environment through django-anymail.
- Playwright browser tests: axe WCAG 2.1 AA on every page in light and
dark, no CSP violations, keyboard walkthrough, theme toggle. Explicit
Canvas/CanvasText on :root fixes dark-mode contrast detection.
- bin/start creates the data dir if missing; docs/operations.md runbook.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Files: prototype and documentation files on features, with versions.
Adding, replacing or removing a file is a feature revision with a
change note. Types come from the extension; uploads are capped at
25 MB and stored under opaque paths. Every file URL checks project
access, then redirects to a short-lived signed URL on the bucket, or
streams with nosniff and a CSP sandbox when no bucket is configured.
HTML prototypes run in a sandboxed iframe without same-origin access.
Threads: whole-file threads and pins at a point on an image, drawn as
an SVG overlay in percentages. Pins are placed with number fields, or
by clicking the image with JS.
Implementations: name, link and status, plus a per-feature status grid
stamped with the feature revision, marked behind when the feature
changes, and confirmable without changing the status.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
