@[email protected] we have some detailed rules on project postings in [email protected] around project promo posts, but I’m not sure how easily that can be handled with non-threadiverse posts, so I’m going to note what I saw here.

• There is AI assistance in the project, as Claude is a contributor
• I only saw a single commit with Claude, which specifically was used to add some constraints around IPs:

fix: close SSRF in /api/v1/trail/download (GHSA-7vqq-mjjr-h9j5) (#1104)

• fix: close SSRF in /api/v1/trail/download (GHSA-7vqq-mjjr-h9j5)

The endpoint fetched a user-supplied URL with no validation, letting
unauthenticated requests reach internal services (PocketBase, Meilisearch)
and cloud metadata endpoints. Add auth gating, protocol/hostname
allowlisting, and DNS-resolved IP validation against private/reserved
ranges (IPv4 and IPv6, including tunneled addresses like 6to4/Teredo/NAT64).
The connection is pinned to the validated IP and redirects are rejected
outright, closing the DNS-rebinding and redirect-based bypasses of a
naive resolve-then-fetch check.

Co-Authored-By: Claude Sonnet 5 [email protected]

• fix url import modal loading

• allow max 5 redirects

---

Co-authored-by: Christian Beutel <>
Co-authored-by: Claude Sonnet 5 [email protected]

Which puts this at pair for implementation, but again only for this one commit as far as I can see.