close #97-#105

diff --git a/.forge/issues/66e7353a-2898-4d28-822d-47c7aee9c862/comments/4a23c1cc-a3de-46e6-a6a6-c7dab76b2d7c.md b/.forge/issues/66e7353a-2898-4d28-822d-47c7aee9c862/comments/4a23c1cc-a3de-46e6-a6a6-c7dab76b2d7c.mdnew file mode 100644index 0000000..ae375c6--- /dev/null+++ b/.forge/issues/66e7353a-2898-4d28-822d-47c7aee9c862/comments/4a23c1cc-a3de-46e6-a6a6-c7dab76b2d7c.md@@ -0,0 +1,6 @@1+---2+id: 4a23c1cc-a3de-46e6-a6a6-c7dab76b2d7c3+author: null4+created: 2026-10-27T18:20:51.786777828Z5+---6+Fixed in PR #60 (`f99cfc4`, merged as `ebb46f4`) with regression coverage in `tests/review4_hardening.rs` and the Pages inbox tests. f0rge CI run `2026-10-27T18-19-28.378320411Z` passed.

diff --git a/.forge/issues/66e7353a-2898-4d28-822d-47c7aee9c862/issue.md b/.forge/issues/66e7353a-2898-4d28-822d-47c7aee9c862/issue.mdindex 7478b91..e6454f6 100644--- a/.forge/issues/66e7353a-2898-4d28-822d-47c7aee9c862/issue.md+++ b/.forge/issues/66e7353a-2898-4d28-822d-47c7aee9c862/issue.md@@ -1,13 +1,13 @@11 ---22 id: 66e7353a-2898-4d28-822d-47c7aee9c86233 title: public-origin postprocessor rewrites raw and release artifact HTML4-state: open4+state: closed55 labels:66 - kind:build77 assignees: []88 milestone: null99 created: 2026-10-27T18:08:32.871053719Z10-updated: null10+updated: 2026-10-27T18:20:51.798751533Z1111 ---1212 ## What1313 

diff --git a/.forge/issues/69c0303b-0dcd-4b1b-a67c-04bcfdde011f/comments/8df694a5-46cb-4ec7-9338-26ad745b9a4f.md b/.forge/issues/69c0303b-0dcd-4b1b-a67c-04bcfdde011f/comments/8df694a5-46cb-4ec7-9338-26ad745b9a4f.mdnew file mode 100644index 0000000..20b91ce--- /dev/null+++ b/.forge/issues/69c0303b-0dcd-4b1b-a67c-04bcfdde011f/comments/8df694a5-46cb-4ec7-9338-26ad745b9a4f.md@@ -0,0 +1,6 @@1+---2+id: 8df694a5-46cb-4ec7-9338-26ad745b9a4f3+author: null4+created: 2026-10-27T18:20:51.707706236Z5+---6+Fixed in PR #60 (`f99cfc4`, merged as `ebb46f4`) with regression coverage in `tests/review4_hardening.rs` and the Pages inbox tests. f0rge CI run `2026-10-27T18-19-28.378320411Z` passed.

diff --git a/.forge/issues/69c0303b-0dcd-4b1b-a67c-04bcfdde011f/issue.md b/.forge/issues/69c0303b-0dcd-4b1b-a67c-04bcfdde011f/issue.mdindex da52168..c36eba2 100644--- a/.forge/issues/69c0303b-0dcd-4b1b-a67c-04bcfdde011f/issue.md+++ b/.forge/issues/69c0303b-0dcd-4b1b-a67c-04bcfdde011f/issue.md@@ -1,13 +1,13 @@11 ---22 id: 69c0303b-0dcd-4b1b-a67c-04bcfdde011f33 title: release artifacts are served as active HTML/SVG (stored XSS)4-state: open4+state: closed55 labels:66 - kind:security77 assignees: []88 milestone: null99 created: 2026-10-27T18:08:25.218070362Z10-updated: null10+updated: 2026-10-27T18:20:51.719490015Z1111 ---1212 ## What1313 

diff --git a/.forge/issues/983bd144-65ee-436f-a783-d80072c63ec5/comments/32002fff-b09c-4c67-b242-293c1fb160e1.md b/.forge/issues/983bd144-65ee-436f-a783-d80072c63ec5/comments/32002fff-b09c-4c67-b242-293c1fb160e1.mdnew file mode 100644index 0000000..56c8f5b--- /dev/null+++ b/.forge/issues/983bd144-65ee-436f-a783-d80072c63ec5/comments/32002fff-b09c-4c67-b242-293c1fb160e1.md@@ -0,0 +1,6 @@1+---2+id: 32002fff-b09c-4c67-b242-293c1fb160e13+author: null4+created: 2026-10-27T18:20:51.886096767Z5+---6+Fixed in PR #60 (`f99cfc4`, merged as `ebb46f4`) with regression coverage in `tests/review4_hardening.rs` and the Pages inbox tests. f0rge CI run `2026-10-27T18-19-28.378320411Z` passed.

diff --git a/.forge/issues/983bd144-65ee-436f-a783-d80072c63ec5/issue.md b/.forge/issues/983bd144-65ee-436f-a783-d80072c63ec5/issue.mdindex 86a1ba5..ff82801 100644--- a/.forge/issues/983bd144-65ee-436f-a783-d80072c63ec5/issue.md+++ b/.forge/issues/983bd144-65ee-436f-a783-d80072c63ec5/issue.md@@ -1,13 +1,13 @@11 ---22 id: 983bd144-65ee-436f-a783-d80072c63ec533 title: release/wiki/feed URLs lack percent-encoding4-state: open4+state: closed55 labels:66 - area:release77 assignees: []88 milestone: null99 created: 2026-10-27T18:08:32.940173587Z10-updated: null10+updated: 2026-10-27T18:20:51.896193721Z1111 ---1212 ## What1313 

diff --git a/.forge/issues/ac514078-d6b2-4e59-94d0-00c523e41936/comments/119d474f-b015-4295-875d-c24fc171bc3d.md b/.forge/issues/ac514078-d6b2-4e59-94d0-00c523e41936/comments/119d474f-b015-4295-875d-c24fc171bc3d.mdnew file mode 100644index 0000000..25fe126--- /dev/null+++ b/.forge/issues/ac514078-d6b2-4e59-94d0-00c523e41936/comments/119d474f-b015-4295-875d-c24fc171bc3d.md@@ -0,0 +1,6 @@1+---2+id: 119d474f-b015-4295-875d-c24fc171bc3d3+author: null4+created: 2026-10-27T18:20:51.810708117Z5+---6+Fixed in PR #60 (`f99cfc4`, merged as `ebb46f4`) with regression coverage in `tests/review4_hardening.rs` and the Pages inbox tests. f0rge CI run `2026-10-27T18-19-28.378320411Z` passed.

diff --git a/.forge/issues/ac514078-d6b2-4e59-94d0-00c523e41936/issue.md b/.forge/issues/ac514078-d6b2-4e59-94d0-00c523e41936/issue.mdindex fe76d4c..2a778e7 100644--- a/.forge/issues/ac514078-d6b2-4e59-94d0-00c523e41936/issue.md+++ b/.forge/issues/ac514078-d6b2-4e59-94d0-00c523e41936/issue.md@@ -1,13 +1,13 @@11 ---22 id: ac514078-d6b2-4e59-94d0-00c523e4193633 title: serve same-origin gate ignores port and scheme4-state: open4+state: closed55 labels:66 - kind:security77 assignees: []88 milestone: null99 created: 2026-10-27T18:08:32.890435135Z10-updated: null10+updated: 2026-10-27T18:20:51.821838165Z1111 ---1212 ## What1313 

diff --git a/.forge/issues/c815bb87-3bbd-44eb-9fb1-cb818ec10a8c/comments/13d7a026-8f58-4112-8040-2a8b9c3bcf95.md b/.forge/issues/c815bb87-3bbd-44eb-9fb1-cb818ec10a8c/comments/13d7a026-8f58-4112-8040-2a8b9c3bcf95.mdnew file mode 100644index 0000000..b47f087--- /dev/null+++ b/.forge/issues/c815bb87-3bbd-44eb-9fb1-cb818ec10a8c/comments/13d7a026-8f58-4112-8040-2a8b9c3bcf95.md@@ -0,0 +1,6 @@1+---2+id: 13d7a026-8f58-4112-8040-2a8b9c3bcf953+author: null4+created: 2026-10-27T18:20:51.734508862Z5+---6+Fixed in PR #60 (`f99cfc4`, merged as `ebb46f4`) with regression coverage in `tests/review4_hardening.rs` and the Pages inbox tests. f0rge CI run `2026-10-27T18-19-28.378320411Z` passed.

diff --git a/.forge/issues/c815bb87-3bbd-44eb-9fb1-cb818ec10a8c/issue.md b/.forge/issues/c815bb87-3bbd-44eb-9fb1-cb818ec10a8c/issue.mdindex e4ee65e..0076f79 100644--- a/.forge/issues/c815bb87-3bbd-44eb-9fb1-cb818ec10a8c/issue.md+++ b/.forge/issues/c815bb87-3bbd-44eb-9fb1-cb818ec10a8c/issue.md@@ -1,13 +1,13 @@11 ---22 id: c815bb87-3bbd-44eb-9fb1-cb818ec10a8c33 title: release artifact filenames inject HTML into release pages4-state: open4+state: closed55 labels:66 - kind:security77 assignees: []88 milestone: null99 created: 2026-10-27T18:08:32.834116005Z10-updated: null10+updated: 2026-10-27T18:20:51.747619077Z1111 ---1212 ## What1313 

diff --git a/.forge/issues/defeff90-dfdb-435e-a6e0-e99d096f8b8d/comments/74310dfe-8ee5-45de-89aa-cee780b31198.md b/.forge/issues/defeff90-dfdb-435e-a6e0-e99d096f8b8d/comments/74310dfe-8ee5-45de-89aa-cee780b31198.mdnew file mode 100644index 0000000..b609ebd--- /dev/null+++ b/.forge/issues/defeff90-dfdb-435e-a6e0-e99d096f8b8d/comments/74310dfe-8ee5-45de-89aa-cee780b31198.md@@ -0,0 +1,6 @@1+---2+id: 74310dfe-8ee5-45de-89aa-cee780b311983+author: null4+created: 2026-10-27T18:20:51.907963633Z5+---6+Fixed in PR #60 (`f99cfc4`, merged as `ebb46f4`) with regression coverage in `tests/review4_hardening.rs` and the Pages inbox tests. f0rge CI run `2026-10-27T18-19-28.378320411Z` passed.

diff --git a/.forge/issues/defeff90-dfdb-435e-a6e0-e99d096f8b8d/issue.md b/.forge/issues/defeff90-dfdb-435e-a6e0-e99d096f8b8d/issue.mdindex 9f57d42..4c550af 100644--- a/.forge/issues/defeff90-dfdb-435e-a6e0-e99d096f8b8d/issue.md+++ b/.forge/issues/defeff90-dfdb-435e-a6e0-e99d096f8b8d/issue.md@@ -1,13 +1,13 @@11 ---22 id: defeff90-dfdb-435e-a6e0-e99d096f8b8d33 title: serve serves og.png as octet-stream4-state: open4+state: closed55 labels:66 - area:render77 assignees: []88 milestone: null99 created: 2026-10-27T18:08:32.955063267Z10-updated: null10+updated: 2026-10-27T18:20:51.918149063Z1111 ---1212 ## What1313 

diff --git a/.forge/issues/f67e6008-5161-4880-b3e7-b685736a69c1/comments/ed0e1113-7718-420c-aa0c-5263427c1fd8.md b/.forge/issues/f67e6008-5161-4880-b3e7-b685736a69c1/comments/ed0e1113-7718-420c-aa0c-5263427c1fd8.mdnew file mode 100644index 0000000..3811cf2--- /dev/null+++ b/.forge/issues/f67e6008-5161-4880-b3e7-b685736a69c1/comments/ed0e1113-7718-420c-aa0c-5263427c1fd8.md@@ -0,0 +1,6 @@1+---2+id: ed0e1113-7718-420c-aa0c-5263427c1fd83+author: null4+created: 2026-10-27T18:20:51.758427629Z5+---6+Fixed in PR #60 (`f99cfc4`, merged as `ebb46f4`) with regression coverage in `tests/review4_hardening.rs` and the Pages inbox tests. f0rge CI run `2026-10-27T18-19-28.378320411Z` passed.

diff --git a/.forge/issues/f67e6008-5161-4880-b3e7-b685736a69c1/issue.md b/.forge/issues/f67e6008-5161-4880-b3e7-b685736a69c1/issue.mdindex ab218cb..cf3faa5 100644--- a/.forge/issues/f67e6008-5161-4880-b3e7-b685736a69c1/issue.md+++ b/.forge/issues/f67e6008-5161-4880-b3e7-b685736a69c1/issue.md@@ -1,13 +1,13 @@11 ---22 id: f67e6008-5161-4880-b3e7-b685736a69c133 title: build panics on multibyte release summary4-state: open4+state: closed55 labels:66 - kind:build77 assignees: []88 milestone: null99 created: 2026-10-27T18:08:32.854172841Z10-updated: null10+updated: 2026-10-27T18:20:51.769025776Z1111 ---1212 ## What1313 

diff --git a/.forge/issues/f9296420-bf9c-41fc-a0da-8955bd400ae7/comments/16a368fc-6ac1-4fb0-84e0-9a35a98dded6.md b/.forge/issues/f9296420-bf9c-41fc-a0da-8955bd400ae7/comments/16a368fc-6ac1-4fb0-84e0-9a35a98dded6.mdnew file mode 100644index 0000000..7e45120--- /dev/null+++ b/.forge/issues/f9296420-bf9c-41fc-a0da-8955bd400ae7/comments/16a368fc-6ac1-4fb0-84e0-9a35a98dded6.md@@ -0,0 +1,6 @@1+---2+id: 16a368fc-6ac1-4fb0-84e0-9a35a98dded63+author: null4+created: 2026-10-27T18:20:51.859521479Z5+---6+Fixed in PR #60 (`f99cfc4`, merged as `ebb46f4`) with regression coverage in `tests/review4_hardening.rs` and the Pages inbox tests. f0rge CI run `2026-10-27T18-19-28.378320411Z` passed.

diff --git a/.forge/issues/f9296420-bf9c-41fc-a0da-8955bd400ae7/issue.md b/.forge/issues/f9296420-bf9c-41fc-a0da-8955bd400ae7/issue.mdindex 05aad74..a979891 100644--- a/.forge/issues/f9296420-bf9c-41fc-a0da-8955bd400ae7/issue.md+++ b/.forge/issues/f9296420-bf9c-41fc-a0da-8955bd400ae7/issue.md@@ -1,13 +1,13 @@11 ---22 id: f9296420-bf9c-41fc-a0da-8955bd400ae733 title: CI redaction corrupts logs for relative repo paths4-state: open4+state: closed55 labels:66 - kind:build77 assignees: []88 milestone: null99 created: 2026-10-27T18:08:32.923269325Z10-updated: null10+updated: 2026-10-27T18:20:51.872437238Z1111 ---1212 ## What1313 

diff --git a/.forge/issues/fb59a187-80c0-4c80-a6f9-3de604f9843d/comments/c405aa42-9771-40a8-843d-f89e3350ae1a.md b/.forge/issues/fb59a187-80c0-4c80-a6f9-3de604f9843d/comments/c405aa42-9771-40a8-843d-f89e3350ae1a.mdnew file mode 100644index 0000000..1baf873--- /dev/null+++ b/.forge/issues/fb59a187-80c0-4c80-a6f9-3de604f9843d/comments/c405aa42-9771-40a8-843d-f89e3350ae1a.md@@ -0,0 +1,6 @@1+---2+id: c405aa42-9771-40a8-843d-f89e3350ae1a3+author: null4+created: 2026-10-27T18:20:51.834421499Z5+---6+Fixed in PR #60 (`f99cfc4`, merged as `ebb46f4`) with regression coverage in `tests/review4_hardening.rs` and the Pages inbox tests. f0rge CI run `2026-10-27T18-19-28.378320411Z` passed.

diff --git a/.forge/issues/fb59a187-80c0-4c80-a6f9-3de604f9843d/issue.md b/.forge/issues/fb59a187-80c0-4c80-a6f9-3de604f9843d/issue.mdindex 7260637..5bfbd35 100644--- a/.forge/issues/fb59a187-80c0-4c80-a6f9-3de604f9843d/issue.md+++ b/.forge/issues/fb59a187-80c0-4c80-a6f9-3de604f9843d/issue.md@@ -1,13 +1,13 @@11 ---22 id: fb59a187-80c0-4c80-a6f9-3de604f9843d33 title: inbox-dir symlink into www exposes private submissions4-state: open4+state: closed55 labels:66 - kind:security77 assignees: []88 milestone: null99 created: 2026-10-27T18:08:32.906968950Z10-updated: null10+updated: 2026-10-27T18:20:51.846193895Z1111 ---1212 ## What1313