forgia · dev log

Engineering log for the forgia LMS platform.

• 23 Jul 26
  A Content-Security-Policy, and Three Things It Caught Before Shipping

  A CSP header allowlisting our own scripts plus Paddle and Bunny, shipped report-only first — which is exactly what caught a frame-src fallback misunderstanding, a Paddle CDN subdomain, and Course thumbnails actually living on Backblaze B2, not local disk.

  securityphoenixplugpaddlebunny
• 14 Jul 26
  The Rate Limiter That Throttles Everyone Except the Attacker

  A magic-link login has no password to brute-force, so the threat isn't guessing — it's spending. Someone else's inbox, and your finite mail quota. The obvious per-IP limit protects neither, and behind a reverse proxy it does something much worse than nothing.

  securityphoenixplughammerrate-limiting