Security & quality pass from full-site review

[HumbleBee14]

Addresses findings from the three-agent site review.

Security (write-portal publishing)

• create-pr: server-side slug validation, file-path allowlist (files confined to the post folder + one author profile), distrust client isEdit (server checks reality and labels updates), payload size caps, optional per-IP rate limit via KV binding
• Real SVG sanitization (allowlist: strips script/foreignObject/on* handlers/non-fragment hrefs) applied in the editor block, serializer, and preview — replaces the script-tag-only strip

Accessibility / motion

• HeroFigure respects prefers-reduced-motion and pauses when off-screen or tab hidden
• Focus management (save/restore + Tab trap + Escape) for publish, open-existing, author, search, and newsletter dialogs
• Light-theme tertiary text darkened to meet WCAG AA contrast

Consistency / dedup

• Shared search logic in lib/search.ts (SearchModal + SearchInline); fixes drifted result meta
• Tag and author-article pages paginated like blog/topics (20/page, shared Pager)
• Core-tools ranking extracted to lib/tools.ts
• Pre-paint theme script reads prefs.ts constants via define:vars

Smaller fixes

• Preview parity (inline-code styles, quote alignment); paste-image ignores block input fields
• Paginated listing pages get lower sitemap priority; KaTeX CSS gated on real math syntax; LCP cover gets fetchpriority; dead playground CSS removed

[cloudflare-workers-and-pages]

Deploying mlsystems with    Cloudflare Pages

Latest commit:	d1ea3e8
Status:	✅  Deploy successful!
Preview URL:	https://d5d45739.mlsystems.pages.dev
Branch Preview URL:	https://fix-security-review.mlsystems.pages.dev

View logs

[github-actions]

Tip

📄 Preview your post →