Weekly development log 2026‑W16: Strengthening CSP, CSRF, Storage, and Security Headers

Weekly log
Vibe coding
Self-hosted AI
2026-W16

Account selection, session exchange with a server, and a separate audit record. A conceptual illustration generated on 2026-10-11, not a product screenshot. It explains this week's theme and does not establish a historical deployment screen or current operational state.

HISTORICAL DEVELOPMENT / EVIDENCE

This week in OpenMake

Security requirements were translated into concrete implementations. We strengthened the Content Security Policy (CSP), WebSocket settings, CSRF defenses, storage rules, and response headers across public-facing and authentication screens.

Period: 2026-04-13 – 2026-04-19
Git commits: 25
Evidence: Git history

Full-history review and additions

Ownership, XSS and SQL boundaries were fixed and CSRF tokens wired into client mutations. The introduction used warn by default; implemented defenses and enforced blocking are distinct.

All reachable history of main 0641c480 was rechecked on 2026-10-18. Counts use committer dates from Monday 00:00 through Sunday 23:59:59 KST, including merges, releases and distinct parallel-branch commits. Commit counts are not feature counts. Tests and operational measurements below are historical source records, not evaluations rerun for this refresh.

What changed

Strengthened CSP and security headers.
Improved CSRF and storage protections.
Reviewed browser security and WebSocket settings.

证据来源

Evidence

OPENMAKE · MIT OPEN SOURCE

在 GitHub 参与构建试用在线演示

查看部署文档

返回开发日志