8 commits

Author	SHA1	Message	Date
MaheshtheDev	3b0fc9c959	fix(web): authenticate and bound metered /api routes (#1589) ... Cherry-picks #1579 and #1580 from @Sravanjangam (security audit #1578), plus improvements on top. - `/api/og`, `/api/onboarding/extract-content` and `/api/onboarding/research` now verify the session against the auth backend; the middleware only checked that a cookie was present, so a forged cookie reached handlers that spend metered Exa/xAI quota. - Bounds those routes: 2MB cap on fetched HTML, max 10 http(s) URLs per request, name/email length limits and a 60s timeout on the LLM call. - De-duplicates URLs before calling Exa, and collapses whitespace in `name`/`email` so a newline can't forge extra prompt lines. Both adapted from @SEPURI-SAI-KRISHNA's #1528 and #1530. - Deletes the unused, unauthenticated `account-status` route. Verified locally: pre-fix `/api/og` returned 200 for a forged cookie, post-fix it returns 401. Five duplicate URLs collapse to two before reaching Exa, and a newline-laden `name` arrives as a single prompt line. Supersedes #1528 and #1530.	2026-08-23 21:48:46 +00:00
Sepuri Sai Krishna	67b6585346	fix(web): block IPv6 literals in OG scraper SSRF guard (#1154)	2026-07-10 18:20:43 -07:00
Rin	f7e97e0233	fix(web): strengthen URL validation and redirect handling in OG scraper (#1059)	2026-06-17 20:28:24 +05:30
Dhravya Shah	e7ea26442a	(probable fix) 500 error on og endpoint	2026-01-23 18:57:14 -07:00
Dhravya Shah	4ca0f593a5	fix: merge conflicts	2026-01-23 17:42:47 -07:00
Dhravya Shah	35004c474a	extract metadata ourselves	2026-01-23 17:39:23 -07:00
MaheshtheDev	8c195cece6	feat: full screen note, space highlights, suggestions (#696) ... Added quick note and highlights features to the new UI, improved OG scraping, and implemented Nova alpha access feature flag.	2026-01-23 22:17:44 +00:00
Mahesh Sanikommu	641db19e35	chore: quick bugs squash across the elements and added few more changes (#671)	2026-01-13 17:53:28 -08:00