paraandClaude Sonnet 5 a46e9c64a2 Harden PHP feeds: block direct cache access, cap curl redirects ...

Security review found no exploitable issue — none of the 3 endpoints
accept user input, so there's no injection surface (upstream URLs are
hardcoded constants, output is XML-escaped). These are defense-in-depth
only: deny direct HTTP access to cache/, and cap CURLOPT_MAXREDIRS to
avoid a hung request on a misbehaving upstream.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-09-25 22:19:36 +02:00

..

.gitkeep

Add PHP variant: no-cron, request-time feed generation for shared hosting

2026-09-25 22:05:26 +02:00

.htaccess

Harden PHP feeds: block direct cache access, cap curl redirects

2026-09-25 22:19:36 +02:00