fix(security): harden public CV edges

2026-08-15 20:53:16 +02:00
parent 74a1e0d845
commit 8ef8b098c8
13 changed files with 54 additions and 6 deletions
@@ -33,6 +33,8 @@ operator/external dependencies belong in `BLOCKERS.md`.
  the full npm high-severity audit to a blocking CI gate.
 - Corrected Chromium PDF export argument handling, bounded hung exports, and verified the returned
  public artifact is a real PDF in the browser smoke suite.
+- Sandboxed authenticated CV preview iframes without enabling scripts, isolated public-PDF request
+  budgets by client and slug, and removed/ignored the tracked expired acceptance JWT artifact.
 - Removed unfinished Portfolio/Notes workspace navigation promises; existing project, attachment,
  and application-note surfaces remain authoritative, and stale section links fall back to Overview.