Skip to content

feat(backtoschool): crawlproof stats.js tag (WebMCP via dashboard) - #425

Merged
ralyodio merged 1 commit into
mainfrom
feat/backtoschool-stats
Nov 11, 2026
Merged

ralyodio merged 1 commit into
mainfrom
feat/backtoschool-stats

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

backtoschool.help has a crawlproof project (bd1d7502…) with the tracker and WebMCP plugin switched on, but its page never loaded stats.js. Adds the tag to backtoschool/index.html. No CSP on that host, so nothing else needed.

🤖 Generated with Claude Code

backtoschool.help had a crawlproof project but its page never loaded the
tracker, so it had no stats and no WebMCP tools.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio
ralyodio merged commit d3d103a into main Nov 11, 2026
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

0 finding(s) in the 1 file(s) this pull request changes.

Nothing in the files this pull request changes.

56 pre-existing finding(s) elsewhere in the repository — **HIGH**: 17 | **MEDIUM**: 15 | **LOW**: 24

Not introduced by this pull request.

Severity Rule Location
HIGH secret-database-url .github/workflows/translation.yml:31
HIGH secret-generic-credential src/hls.ts:81
HIGH js-ssrf-outbound-request src/music-hub.ts:304
HIGH js-host-header-trust src/server.ts:3111
HIGH js-host-header-trust src/server.ts:3125
HIGH js-host-header-trust src/server.ts:3142
HIGH js-host-header-trust src/server.ts:3151
HIGH js-host-header-trust src/server.ts:3156
HIGH js-host-header-trust src/server.ts:3259
HIGH js-host-header-trust src/server.ts:3325
HIGH js-host-header-trust src/server.ts:3412
HIGH js-host-header-trust src/server.ts:3440
HIGH js-host-header-trust src/server.ts:3610
HIGH js-host-header-trust src/server.ts:3626
HIGH js-ssrf-outbound-request web/src/app.ts:115
HIGH js-ssrf-outbound-request web/src/app.ts:163
HIGH js-ssrf-outbound-request web/src/app.ts:167
MEDIUM js-unescaped-html-sink backtoschool/src/main.ts:95
MEDIUM js-unescaped-html-sink backtoschool/src/main.ts:241
MEDIUM js-unescaped-html-sink backtoschool/src/main.ts:257

…and 36 more; the full set is in the SARIF artifact.

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant