Skip to content

Serve an OpenAccess descriptor - #251

Merged
ralyodio merged 2 commits into
masterfrom
openaccess-descriptor
Sep 12, 2026
Merged

ralyodio merged 2 commits into
masterfrom
openaccess-descriptor

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Adds public/.well-known/openaccess.json so crawlproof.com is listed on openaccess.logicsrc.com, can be linked with OAuth 2.1 + PKCE, and honours the shared profullstack.com/all-access entitlement. Static file only; no runtime change. The private key is vaulted in logicsrc teams openaccess-app-keys--prod.

Spec: https://logicsrc.com/openaccess

🤖 Generated with Claude Code

https://claude.ai/code/session_01SWRffW4ifQPUrGXJtgYWMd

Lists CrawlProof on OpenAccess hubs (openaccess.logicsrc.com) so people can
link it with OAuth 2.1 + PKCE and it honours the shared
profullstack.com/all-access entitlement. The Ed25519 public key here is
the app's credential for reporting sales; the private half is in the
logicsrc teams vault openaccess-app-keys--prod. Scopes are empty for now:
the reserved openid, email and entitlements scopes need no listing.

Spec: https://logicsrc.com/openaccess

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SWRffW4ifQPUrGXJtgYWMd
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

39 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 28 | LOW: 9

Severity Rule Location
HIGH tls-verification-disabled lib/onion.ts:48
HIGH secret-generic-credential lib/sp/platforms/facebook.ts:32
MEDIUM js-unescaped-html-sink app/(app)/dashboard/admin/email-broadcast/EmailBroadcastForm.tsx:125
MEDIUM js-unescaped-html-sink app/(app)/dashboard/projects/[id]/autoblog/articles/[articleId]/page.tsx:214
MEDIUM js-unescaped-html-sink app/(marketing)/blog/[slug]/page.tsx:67
MEDIUM js-unescaped-html-sink app/(marketing)/blog/[slug]/page.tsx:97
MEDIUM js-unescaped-html-sink app/(marketing)/blog/[slug]/page.tsx:104
MEDIUM js-unescaped-html-sink app/(marketing)/blog/[slug]/page.tsx:110
MEDIUM js-unescaped-html-sink app/(marketing)/recent/page.tsx:186
MEDIUM js-unescaped-html-sink app/(marketing)/recent/page.tsx:190
MEDIUM js-unescaped-html-sink app/c/[project]/[slug]/page.tsx:77
MEDIUM js-unescaped-html-sink app/c/[project]/page.tsx:57
MEDIUM js-unescaped-html-sink app/careers.js/route.ts:228
MEDIUM js-unescaped-html-sink app/careers.js/route.ts:285
MEDIUM js-unescaped-html-sink app/layout.tsx:129
MEDIUM js-open-redirect app/login/form.tsx:39
MEDIUM js-unescaped-html-sink app/r/[token]/page.tsx:176
MEDIUM js-open-redirect app/signup/form.tsx:43
MEDIUM js-open-redirect components/billing/buy-credits-modal.tsx:98
MEDIUM js-unescaped-html-sink components/json-ld.tsx:8
MEDIUM js-unescaped-html-sink components/report/markdown-view.tsx:15
MEDIUM js-unescaped-html-sink lib/careers/page-templates.ts:198
MEDIUM redos-nested-quantifier lib/emailMarkdown.ts:41
MEDIUM redos-nested-quantifier lib/emailMarkdown.ts:324
MEDIUM redos-nested-quantifier lib/lx/articleGen.ts:99
MEDIUM redos-nested-quantifier lib/tracker/agent-gate.ts:61
MEDIUM sh-remote-script-execution prober/deploy/provision.sh:30
MEDIUM sql-template-interpolation scripts/detect-slot-themes.ts:31
MEDIUM sql-template-interpolation scripts/purge-constructed-keywords.ts:163
MEDIUM sql-template-interpolation scripts/purge-offniche-keywords.ts:124
LOW secret-generic-credential app/(marketing)/docs/autoblog-webhook/page.tsx:145
LOW secret-generic-credential lib/sp/platforms/linkedin.ts:25
LOW js-dynamic-code-execution tests/careers-page-templates.test.ts:21
LOW js-dynamic-code-execution tests/careers-widget-script.test.ts:19
LOW js-dynamic-code-execution tests/careers-widget-script.test.ts:69
LOW js-dynamic-code-execution tests/contract/ad-visitor-id.test.ts:51
LOW js-dynamic-code-execution tests/contract/ad-visitor-id.test.ts:52
LOW secret-generic-credential tests/contract/posthog-integration.test.ts:13
LOW secret-generic-credential tests/lead-campaign.test.ts:16

Snippets are redacted; ThreatCrush never prints matched credential material.

Lists this app's MCP endpoint on OpenMCP catalogs (openmcp.logicsrc.com)
as verified: where the endpoint is, how to authenticate, what it is for,
the tools, and the operator. Spec: https://logicsrc.com/openmcp

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SWRffW4ifQPUrGXJtgYWMd
@ralyodio
ralyodio merged commit 9ed56a3 into master Sep 12, 2026
10 checks passed
@ralyodio
ralyodio deleted the openaccess-descriptor branch September 12, 2026 19:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant