Sixty-two commits landed on the working branch since the last entry. Every confirmed finding from last week’s security audit is closed in the code: twenty-nine of them, each fixed with a failing test in front of it. The forms that ask where a gym is now open on a guess taken from the address. And an account one step short of a second factor is told so the moment it signs in, not the first time something stops it.
Twenty-nine findings, and none left in the code
The audit confirmed twenty-nine findings: none critical, one high, twelve medium, fifteen low, one informational, with five further candidates examined and rejected. The high one was the subject of the last entry; the other twenty-eight closed over the following day, and the audit log reads nought open in the code.
Each is small on its own, and the list is the point. A spreadsheet export now defuses a formula after every semicolon, not only at the first character: a sheet set to Spanish conventions starts a new cell at each semicolon, so a formula in the second one was still live. Deleting an account ends every grant made to it and every grant it made, in one transaction, and withdraws its open gym claims, so the proof mailbox goes with the account. The site pins HTTPS for a year. And the operator’s own commands print every control character as a visible escape, so text typed into a public form cannot rewrite the terminal of whoever reads it back.
The three map forms open on a guess from the address
Adding a gym, moving one and pre-registering all show a map, and every pin used to be dropped by hand. All three now open on a spot proposed from the address. The service behind it is OpenStreetMap’s public Nominatim, used within its usage policy: an identifying User-Agent, one request a second for the whole site, answers cached for a day.
The browser never talks to it. One endpoint of ours takes the six parts that locate a building, is blind to cookies, is capped at twenty requests a minute per address, and answers with a proposal or with nothing. On screen the guess is a hollow ring with Use this spot beside it. Nothing is saved or sent from a guess: the address is recorded only when somebody accepts the spot or moves the pin themselves, and a map a person has already touched is never moved under them. Both privacy pages name the OpenStreetMap Foundation as the processor, in both languages. 101 of 101 browser tests.
A code before a new sheet, and a nudge straight after signing in
The rule from the last entry now has a screen. Issue a new set opens a panel under the recovery codes and asks for the app’s current code or one of the remaining codes. Nothing typed, a wrong app code and a spent or unknown code each get their own sentence, because three refusals that read alike tell the person nothing. Checked at 390 and at 1180 pixels: 1,777 of 1,777 in the module’s suite, 26 of 26 on the account spec, six mutations all killed.
Straight after a sign-in, an account with a password and exactly one passkey now sees One more way of proving it is you before the console opens: set up the app, or add a second passkey. The offer carries where you were going, so you land there afterwards, and Not now opens the console with focus on its heading. 10,390 unit tests green, twelve of twelve on the arrival.
The owner’s two lists, and a gate that refuses a real person’s address
The two lists Design drew for the owner are built. Gym records lists every record by name and never names a person who trains there; gym accounts is read-only, each account’s dormant state read from the sweep’s own rule. Open lands on that record inside the moderation panel, with the control to stop showing it.
A new gate check reads every tracked text file and fails on an email address whose domain is not reserved, unless it is a listed, reasoned exception; a finding prints the domain and never the address. The scheduled duties now leave one dated line a day in the site log, because a keep-alive proves a request and only that line proves they ran. Design’s round 70 came in with 371 files measured, 43 of them new. And every step of the help site is now Design’s words.
51 checks, 10,175 unit tests and 1,456 browser tests
The gate reads 51 checks, all green. Its last written full run read 10,175 unit tests and 1,456 browser tests, up from 10,146, and the suites kept growing with every slice after it: the last of the day ran 10,401 green. The standing counts, each written by the check that derives it: 55 routes, 27 rate-limited; 1,873 rule citations resolving by number, up from 1,871; documented coverage across 252 modules, up from 251; 81 artboards; Node pinned at 22.23.2.
What comes next
More slices from the same queue, each starting from a failing test, and the work towards opening the free gym listing carries on behind them.
If you would rather be told when GymAI opens than keep checking, the waiting list is on gymai.coach.
No comments yet
Nobody has written anything here. You can be the first.