[ralyodio]

Server-rendered /privacy and /terms (h1 Privacy Policy / Terms of Service, effective November 11, 2026) for the Claude Connectors Directory and ChatGPT apps submissions, one set per host:

• nixamp.com: accounts, chat (public, permanent), purchases via CoinPay, Resend, Telnyx, CrawlProof, AI providers for AI radio, and MCP at /mcp (bearer/OAuth) and /mcp/public.
• backtoschool.help: classes, chat, raised hands, invitations, Write with AI, MCP at /mcp and /mcp/public; children clause states it is general audience and collects nothing about students beyond account/chat data.
• Answered only for nixamp.com and the school host; a self-hosted box keeps 404.
• Footer: Privacy/Terms in nixamp.com status bar + shared footer site links, and in the backtoschool site footer.
• test/legal.test.ts covers both hosts and the self-host case.

Local: tsc clean; bun run test 1144 pass, 2 fail (party-cli/naming read my real ~/ nixamp session; both pass with a clean HOME); web:build and backtoschool:build OK.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

12 finding(s) in the 6 file(s) this pull request changes.

HIGH: 11 | MEDIUM: 1

Severity	Rule	Location
HIGH	js-host-header-trust	src/server.ts:3129
HIGH	js-host-header-trust	src/server.ts:3143
HIGH	js-host-header-trust	src/server.ts:3160
HIGH	js-host-header-trust	src/server.ts:3169
HIGH	js-host-header-trust	src/server.ts:3174
HIGH	js-host-header-trust	src/server.ts:3277
HIGH	js-host-header-trust	src/server.ts:3343
HIGH	js-host-header-trust	src/server.ts:3430
HIGH	js-host-header-trust	src/server.ts:3458
HIGH	js-host-header-trust	src/server.ts:3628
HIGH	js-host-header-trust	src/server.ts:3644
MEDIUM	redos-nested-quantifier	src/server.ts:4839

44 pre-existing finding(s) elsewhere in the repository — **HIGH**: 6 | **MEDIUM**: 14 | **LOW**: 24

Not introduced by this pull request.

Severity	Rule	Location
HIGH	secret-database-url	.github/workflows/translation.yml:31
HIGH	secret-generic-credential	src/hls.ts:81
HIGH	js-ssrf-outbound-request	src/music-hub.ts:304
HIGH	js-ssrf-outbound-request	web/src/app.ts:115
HIGH	js-ssrf-outbound-request	web/src/app.ts:163
HIGH	js-ssrf-outbound-request	web/src/app.ts:167
MEDIUM	js-unescaped-html-sink	backtoschool/src/main.ts:95
MEDIUM	js-unescaped-html-sink	backtoschool/src/main.ts:241
MEDIUM	js-unescaped-html-sink	backtoschool/src/main.ts:257
MEDIUM	js-unescaped-html-sink	backtoschool/src/main.ts:281
MEDIUM	js-unescaped-html-sink	backtoschool/src/main.ts:366
MEDIUM	js-unescaped-html-sink	backtoschool/src/main.ts:494
MEDIUM	js-unescaped-html-sink	web/src/app.ts:391
MEDIUM	js-unescaped-html-sink	web/src/app.ts:392
MEDIUM	js-timing-unsafe-mac-compare	web/src/app.ts:2454
MEDIUM	js-open-redirect	web/src/app.ts:3869
MEDIUM	js-unescaped-html-sink	web/src/app.ts:7376
MEDIUM	js-unescaped-html-sink	web/src/control-icons.ts:19
MEDIUM	insecure-randomness-for-secret	web/src/music.ts:419
MEDIUM	insecure-randomness-for-secret	web/src/station.ts:314

…and 24 more; the full set is in the SARIF artifact.

Snippets are redacted; ThreatCrush never prints matched credential material.