forgia · dev log
Engineering log for the forgia LMS platform.
- 09 Aug 26The Invitation That Knows Who You Are
An Invitation is bound to one exact email, so a typo at sign-up throws it away. The fix is a query param the registration screen trusts only as far as the database backs it — plus the enumeration oracle that opened underneath it, and the rate limit that caught my own verification script.
securityonboardingphoenixemaildesign-system - 23 Jul 26A Content-Security-Policy, and Three Things It Caught Before Shipping
A CSP header allowlisting our own scripts plus Paddle and Bunny, shipped report-only first — which is exactly what caught a frame-src fallback misunderstanding, a Paddle CDN subdomain, and Course thumbnails actually living on Backblaze B2, not local disk.
securityphoenixplugpaddlebunny - 15 Jul 26The Feature Was Named After the One Thing It Must Never Do
The Card asked for a banner warning users about downtime. The design system called the section 'Maintenance mode'. Building it well meant refusing that name — because the whole point of this banner is that the site stays up.
liveviewectopostgresddddesign-systemsecurity - 14 Jul 26The Rate Limiter That Throttles Everyone Except the Attacker
A magic-link login has no password to brute-force, so the threat isn't guessing — it's spending. Someone else's inbox, and your finite mail quota. The obvious per-IP limit protects neither, and behind a reverse proxy it does something much worse than nothing.
securityphoenixplughammerrate-limiting - 11 Jul 26Word Match Lessons
A fourth Lesson type: the instructor marks Blanks in a passage with four delimiter pairs, the student refills them from a shuffled Word Bank salted with Distractors, and the server checks — returning nothing but a count of errors.
liveviewword-matchectodesign-systemdddsecurity - 31 May 26Code Review: 10 Security and Quality Fixes
A code review pass found 10 issues across the codebase — from a cross-course lesson access hole to a TOCTOU race in enrollment. Here's what was fixed and why.
securitycode-reviewhardeningliveviewecto