feat(shortener): Safe Browsing scanning + abuse reporting#72

Open

PenguinzTech wants to merge 19 commits into

release/v0.1.xfrom

feature/link-safety-scanning

Commits on Jul 14, 2026

fix(auth): require JWT_SECRET_KEY in prod + run config validation at startup

PenguinzTech
and
claude
committed
fix(oidc): validate ID tokens, add PKCE+nonce, stop email auto-link, tokens off URL

PenguinzTech
and
claude
committed
fix(rbac): enforce tenant/team membership on object routes (OH1/OH2/OH3/H1)

PenguinzTech
and
claude
committed
fix(rbac): require team/tenant admin on all write/admin routes (IDOR follow-up)

PenguinzTech
and
claude
committed
fix(auth): revocable access tokens (jti) + rate limiting + auth on oauth introspect/revoke (C3/H3/M4/OM1)

PenguinzTech
and
claude
committed
fix(backend): refresh-token claims, startup table defs, tz-aware datetime, logged errors, safe admin seed (OM4/M1/M2/M3/H2)

PenguinzTech
and
claude
committed
feat(shortener): link + collection API with tenant scoping, secure codes, SSRF-safe URL validation (B1-B2)

PenguinzTech
and
claude
committed
feat(shortener): public redirect + async click tracking + QR + analytics (B3-B4)

PenguinzTech
and
claude
committed
feat(shortener): Free/Pro/Enterprise tier gating via feature flags + license (B5)

PenguinzTech
and
claude
committed
test: cover advanced analytics + redirect edge paths (raise merged coverage >90%)

PenguinzTech
and
claude
committed

Commits on Jul 15, 2026