| Increase code-page section spacing to 32px | 123 | closed | 2 | |
| Normalize code-page vertical spacing | 122 | closed | 1 | |
| README: drop duplicate repo-name heading | 121 | closed | 1 | |
| Stack Files then README on the code tab at every width | 120 | closed | 1 | |
| README: drop duplicate ASCII logos and source-path hint | 119 | closed | 1 | |
| Use the gf1 gl0w logo in the header/footer lockup | 118 | closed | 1 | |
| serve prepare_git_dir follows a repo.bundle symlink outside www | 117 | closed | 1 | |
| Pages inbox quota stops checking at 1000 objects; rate map has no hard cap | 116 | closed | 1 | |
| serve omits the Referrer-Policy header that Pages sends globally | 115 | closed | 1 | |
| Agents guide claims checkbox state and body hash are stored, but they are not | 114 | closed | 1 | |
| Unknown top-level subcommand exits 0 | 113 | closed | 1 | |
| Relative markdown links/images and heading anchors 404 in generated pages | 112 | closed | 1 | |
| serve 404.html symlink escapes www and leaks host files | 111 | closed | 1 | |
| Reserved index names can overwrite section indexes (releases/issues/pulls/wiki) | 110 | closed | 1 | |
| Cloudflare Pages clean-URL redirects break the one-shape canonical URL contract | 109 | closed | 1 | |
| parse_ts_secs panics on multibyte timestamps | 108 | closed | 1 | |
| Hostile .forge symlinks escape the repo and publish host files | 107 | closed | 1 | |
| Pages artifact download policy is invalid (two splats), allowing active HTML/SVG | 106 | closed | 1 | |
| serve serves og.png as octet-stream | 105 | closed | 1 | |
| release/wiki/feed URLs lack percent-encoding | 104 | closed | 1 | |
| CI redaction corrupts logs for relative repo paths | 103 | closed | 1 | |
| inbox-dir symlink into www exposes private submissions | 102 | closed | 1 | |
| serve same-origin gate ignores port and scheme | 101 | closed | 1 | |
| public-origin postprocessor rewrites raw and release artifact HTML | 100 | closed | 1 | |
| build panics on multibyte release summary | 99 | closed | 1 | |
| release artifact filenames inject HTML into release pages | 98 | closed | 1 | |
| release artifacts are served as active HTML/SVG (stored XSS) | 97 | closed | 1 | |
| polish: dir: src H1; relative Atom feed links | 96 | closed | 0 | |
| og:image is relative (needs public origin for scrapers) | 95 | closed | 0 | |
| CI logs publish absolute builder paths | 94 | closed | 0 | |
| raw policy differs between serve and _headers | 93 | closed | 0 | |
| mobile: PR head→base breaks inside branch names | 92 | closed | 0 | |
| responsive: nav clipped at 768–1099; separator dots wrap onto line starts | 91 | closed | 0 | |
| light theme: diff text fails AA; form fields look disabled (border 1.2:1) | 90 | closed | 0 | |
| file paths in hrefs are not percent-encoded (# ? % break navigation) | 89 | closed | 0 | |
| file pages: phantom final line for trailing newline / CRLF | 88 | closed | 0 | |
| diff: added lines starting +++/--- are misclassified as file headers | 87 | closed | 0 | |
| diff: block rows separated by newlines render a blank line between every row | 86 | closed | 0 | |
| 404: emit branded 404.html and serve it on unknown paths | 85 | closed | 0 | |
| footer: submit link points at POST-only /inbox/issue (405) | 84 | closed | 0 | |
| issues/pulls: generated HTML in title= corrupts every row | 83 | closed | 0 | |
| build: bound and validate timestamps (hostile dates panic or normalize) | 82 | closed | 0 | |
| build: enforce Cloudflare Pages 20k-file / 25 MiB limits | 81 | closed | 0 | |
| serve: static GET/HEAD buffers whole file in RAM (OOM on large raw files) | 80 | closed | 0 | |
| Cloudflare: implement Pages Functions + R2 inbox (current deploy has no inbox) | 79 | closed | 0 | |
| highlight: O(n²) per-char suffix allocation makes builds take minutes | 78 | closed | 0 | |
| build: -o guard bypass via .. / symlink deletes parent or repo (data loss) | 77 | closed | 0 | |
| Light theme retune + AA contrast pass (--muted is 2.76:1 dark / 4.26:1 light) | 76 | closed | 1 | |
| Responsive fixes: nav reachable at 390px, files table, clone summary wrapping | 75 | closed | 1 | |
| Diffs: per-file cards, dual line numbers, visual diffstat, drop mbox preamble | 74 | closed | 1 | |
| Code view: add build-time syntax highlighting (no JS) + line-number gutter + file toolbar | 73 | closed | 1 | |
| Meta/date/authors pass: state pills, label chips, monograms, relative dates, demote internal ids | 72 | closed | 1 | |
| Markdown: enable GFM tables + task lists + strikethrough (Options::empty() disables them) | 71 | closed | 1 | |
| Brand v1: gl0w + hu13 lockup, branded footer with gl0w.world, og:image, theme-aware logo | 70 | closed | 1 | |
| Design foundations: raise the CSS budget (49 bytes free) + spacing/type/color scale | 69 | closed | 1 | |
| Small robustness/consistency batch: '.' repo name, gitlink pages, inbox list escaping, content-type anchor, symlink gap | 68 | closed | 1 | |
| build never cleans out/: deleted issues/files keep being served | 67 | closed | 1 | |
| build aborts (allocator) on large blobs: every file is read fully into memory | 66 | closed | 1 | |
| RateLimiter: per-key map never evicts, so source-IP rotation grows memory without bound | 65 | closed | 1 | |
| serve: git upload-pack has no timeout, no concurrency cap, and fully buffers the pack | 64 | closed | 1 | |
| serve: unbounded thread-per-connection + 500ms ack sleep = trivial availability DoS | 63 | closed | 2 | |
| Markdown link/image URLs are not scheme-filtered (javascript: XSS) | 62 | closed | 1 | |
| Stored XSS: raw/<path> serves committed HTML/SVG as text/html | 61 | closed | 1 | |
| Build-time path traversal: forge frontmatter id/version writes outside the output dir | 60 | closed | 1 | |
| Clone docs + repo hygiene after #54 (Dockerfile, wiki/deploy, .gitignore, unset-mode UX) | 59 | closed | 1 | |
| Export duplicates the git runner, shares the 10s timeout, and round-trips paths through UTF-8 | 58 | closed | 1 | |
| repo.git publishes local filesystem path in config | 57 | closed | 1 | |
| repo.git is 260 files / 226 loose objects (Pages 20k-file cap, dumb clone = 1 GET per object) | 56 | closed | 1 | |
| repo.git leaks unreachable objects (not an exact snapshot) | 55 | closed | 1 | |
| Dumb static git clone via repo.git | 54 | closed | 0 | |
| Branch+CI into clone summary, drop dupe line | 53 | closed | 1 | |
| Right-align footer text | 52 | closed | 1 | |
| 2x header logo size | 51 | closed | 1 | |
| Consistent page-head spacing everywhere | 50 | closed | 1 | |
| Issues/pulls newest-first | 49 | closed | 1 | |
| Open issues first in table | 48 | closed | 1 | |
| Cards: title first, number second | 47 | closed | 1 | |
| File table stays a table on mobile | 46 | closed | 1 | |
| Code tab: files + README side by side on desktop | 45 | closed | 1 | |
| Clone details: remove blank line under summary | 44 | closed | 1 | |
| Code page CI badge green/red | 43 | closed | 1 | |
| Truncate all table fields (desktop overflow) | 42 | closed | 1 | |
| Footer provenance line on all pages | 41 | closed | 1 | |
| Code page: breathing room under navbar | 40 | closed | 1 | |
| Replace scroll-tables with stacked cards on mobile | 39 | closed | 1 | |
| Hide empty sections from header nav | 38 | closed | 1 | |
| Language bar: obey gitignore, skip binaries | 37 | closed | 1 | |
| Remove redundant counts line from code tab | 36 | closed | 1 | |
| BUG: extensionless wiki README not shown | 35 | closed | 1 | |
| Clone block collapsed (details) | 34 | closed | 1 | |
| Code page Gitea-style (file table + language bar) | 33 | closed | 1 | |
| Autogenerated clone-from-server (public-origin) | 32 | closed | 1 | |
| Buttons inline beside page titles | 31 | closed | 1 | |
| Tables scroll naturally, never squash | 30 | closed | 1 | |
| Nav counters: open only | 29 | closed | 1 | |
| Header: logo only, drop name nodes | 28 | closed | 1 | |
| Logo with hu13 text baked in (vector paths) | 27 | closed | 1 | |
| Owner block-art logo (ansi + plain) | 26 | closed | 2 | |
| + submit buttons on issues/pulls pages | 25 | closed | 1 | |
| Repo name via flags/env (header + title + feed) | 24 | closed | 1 | |
| Beautiful wiki README (ascii art, human tour) | 23 | closed | 1 | |
| Tokyo Night diff coloring (dark+light) | 22 | closed | 1 | |
| Description via flags/env (header + og) | 21 | closed | 1 | |
| Code page conventions (breadcrumbs, anchors, clone block) | 20 | closed | 1 | |
| Tokyo Night light theme (prefers-color-scheme) | 19 | closed | 1 | |
| Navbar+logo one bar (bullet separators, scrollable nav) | 18 | closed | 1 | |
| Tables on issues/pulls break mobile layout | 17 | closed | 1 | |
| Favicon + head standards (manifest, og, theme-color) | 16 | closed | 1 | |
| hu13 logo (svg + ascii) | 15 | closed | 1 | |
| Responsive design: mobile + desktop | 14 | closed | 1 | |
| v1 verification gate (iterate till verified) | 13 | closed | 2 | |
| DEFERRED: license text owner re-read pre-v1 | 12 | closed | 2 | |
| Docker build-on-start + dogfood + polish | 11 | closed | 1 | |
| Inbox hardening: caps, rate, abuse suite | 10 | closed | 1 | |
| Inbox core: forms, POSTs, storage, ack, license | 9 | closed | 1 | |
| Releases+artifacts, api JSON, agents page | 8 | closed | 1 | |
| f0rge readers: issues/prs/tasks/ci/labels | 7 | closed | 1 | |
| feed.atom (50, commits+releases) | 6 | closed | 1 | |
| Commits pages + per-commit diffs + wiki | 5 | closed | 1 | |
| Code tab: index, files/raw, clone chain, snapshots | 4 | closed | 1 | |
| Git reader module (log/tree/show/diff/bundle/tarball) | 3 | closed | 1 | |
| Scaffold: crate, style, layout, CI steps, gl0w.md | 2 | closed | 3 | |
| R1 spike: markdown+frontmatter deps decision | 1 | closed | 1 | |
