Skip to content

fix: open /privacy and /terms to crawlers on both hosts - #427

Merged
ralyodio merged 1 commit into
mainfrom
fix/legal-open-to-crawlers
Nov 11, 2026
Merged

ralyodio merged 1 commit into
mainfrom
fix/legal-open-to-crawlers

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

The crawl gate (src/paywall.ts createCrawlGate) returned 402 for /privacy and /terms to bot UAs (ClaudeBot, GPTBot) on nixamp.com and backtoschool.help, so a connector directory review crawler could not read them. Adds both to the gateway openPaths (as profullstack/bufferoverride#45 did); the gate is path-based and one per process, so this covers both hosts. Test: GPTBot and ClaudeBot get through on both hosts.

Local: tsc clean; bun test test/paywall.test.ts test/legal.test.ts, 16 pass.

🤖 Generated with Claude Code

The crawl gate answered 402 to ClaudeBot and other crawlers on the legal
pages of nixamp.com and backtoschool.help, which a connector directory's
review crawler must read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

0 finding(s) in the 2 file(s) this pull request changes.

Nothing in the files this pull request changes.

56 pre-existing finding(s) elsewhere in the repository — **HIGH**: 17 | **MEDIUM**: 15 | **LOW**: 24

Not introduced by this pull request.

Severity Rule Location
HIGH secret-database-url .github/workflows/translation.yml:31
HIGH secret-generic-credential src/hls.ts:81
HIGH js-ssrf-outbound-request src/music-hub.ts:304
HIGH js-host-header-trust src/server.ts:3129
HIGH js-host-header-trust src/server.ts:3143
HIGH js-host-header-trust src/server.ts:3160
HIGH js-host-header-trust src/server.ts:3169
HIGH js-host-header-trust src/server.ts:3174
HIGH js-host-header-trust src/server.ts:3277
HIGH js-host-header-trust src/server.ts:3343
HIGH js-host-header-trust src/server.ts:3430
HIGH js-host-header-trust src/server.ts:3458
HIGH js-host-header-trust src/server.ts:3628
HIGH js-host-header-trust src/server.ts:3644
HIGH js-ssrf-outbound-request web/src/app.ts:115
HIGH js-ssrf-outbound-request web/src/app.ts:163
HIGH js-ssrf-outbound-request web/src/app.ts:167
MEDIUM js-unescaped-html-sink backtoschool/src/main.ts:95
MEDIUM js-unescaped-html-sink backtoschool/src/main.ts:241
MEDIUM js-unescaped-html-sink backtoschool/src/main.ts:257

…and 36 more; the full set is in the SARIF artifact.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 92ec9fa into main Nov 11, 2026
5 checks passed
@ralyodio
ralyodio deleted the fix/legal-open-to-crawlers branch November 11, 2026 14:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant