Define tech stack: stakereloadxs.Com#16

Open

4eckd wants to merge 15 commits intofeat/stakereloadxs-brandingfrom

claude/define-tech-stack-C37J3

Commits on Mar 18, 2026

feat: scaffold StakeReloadXS.com Next.js frontend with multi-brand deploy system
claude
committed
feat: v2 — user journeys, design token system, admin GUI, /status, OG images, cron
claude
committed
fix: rename next.config.ts → next.config.js for Next.js 14 compatibility
claude
committed
Fix: JSDoc comment contains `*/` in cron schedule which prematurely closes the comment block, causing "Expression expected" syntax error

vercel[bot]
and
4eckd
committed
fix: upgrade Next.js 15, ESLint 9, establish monorepo packages
claude
committed
Merge remote-tracking branch 'origin/claude/define-tech-stack-C37J3' into claude/define-tech-stack-C37J3
claude
committed
fix: add root vercel.json to resolve monorepo Next.js detection
claude
committed
Fix: New monorepo packages have incorrect "main" field pointing to TypeScript source files instead of following proper package.json conventions for TypeScript-only workspace packages

vercel[bot]
and
4eckd
committed
Fix: JSDoc comment contains `*/15 * * * *` cron expression which prematurely closes the comment block, causing syntax error

vercel[bot]
and
4eckd
committed
Fix: Unvalidated URL redirection: `window.location.href` is set directly to `data.paymentUrl` from API response without validation, allowing potential XSS/redirect attacks

vercel[bot]
and
4eckd
committed
Fix: XSS vulnerability: gaId environment variable interpolated directly into JavaScript code via dangerouslySetInnerHTML without escaping

vercel[bot]
and
4eckd
committed
Fix: Tawk propertyId and widgetId are interpolated into script content without proper escaping, allowing potential string escape and code injection if these configuration values are compromised

vercel[bot]
and
4eckd
committed
Fix: POST endpoint in cron route lacks authentication check, allowing unauthorized users to retrieve sensitive cached status snapshots

vercel[bot]
and
4eckd
committed
Fix: Missing server-side validation of packageId, packageName, price, and credits parameters allows attackers to create payment invoices with arbitrary values

vercel[bot]
and
4eckd
committed

Commits on Mar 19, 2026

Fix: Cron POST and GET endpoints skip authentication if CRON_SECRET environment variable is not configured, allowing unauthorized access to cached status snapshots

vercel[bot]
and
4eckd
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Define tech stack: stakereloadxs.Com#16

Define tech stack: stakereloadxs.Com#16
4eckd wants to merge 15 commits intofeat/stakereloadxs-brandingfrom
claude/define-tech-stack-C37J3

Commits on Mar 18, 2026

feat: scaffold StakeReloadXS.com Next.js frontend with multi-brand deploy system

feat: v2 — user journeys, design token system, admin GUI, /status, OG images, cron

fix: rename next.config.ts → next.config.js for Next.js 14 compatibility

Fix: JSDoc comment contains `*/` in cron schedule which prematurely closes the comment block, causing "Expression expected" syntax error

fix: upgrade Next.js 15, ESLint 9, establish monorepo packages

Merge remote-tracking branch 'origin/claude/define-tech-stack-C37J3' into claude/define-tech-stack-C37J3

fix: add root vercel.json to resolve monorepo Next.js detection

Fix: New monorepo packages have incorrect "main" field pointing to TypeScript source files instead of following proper package.json conventions for TypeScript-only workspace packages

Fix: JSDoc comment contains `/15 * * *` cron expression which prematurely closes the comment block, causing syntax error

Fix: Unvalidated URL redirection: `window.location.href` is set directly to `data.paymentUrl` from API response without validation, allowing potential XSS/redirect attacks

Fix: XSS vulnerability: gaId environment variable interpolated directly into JavaScript code via dangerouslySetInnerHTML without escaping

Fix: Tawk propertyId and widgetId are interpolated into script content without proper escaping, allowing potential string escape and code injection if these configuration values are compromised

Fix: POST endpoint in cron route lacks authentication check, allowing unauthorized users to retrieve sensitive cached status snapshots

Fix: Missing server-side validation of packageId, packageName, price, and credits parameters allows attackers to create payment invoices with arbitrary values

Commits on Mar 19, 2026

Fix: Cron POST and GET endpoints skip authentication if CRON_SECRET environment variable is not configured, allowing unauthorized access to cached status snapshots