Add documentation and fix Dependabot and CodeQL alerts

[aamoghS]

Single commit thread, authored by aamoghS, combining the docs work and the security fixes. Replaces #352 and #354.

Documentation

docs/ covers architecture, local setup, packages, both sites, CI/CD, deployment, security, and testing. Root and package READMEs point there.

Security / CodeQL

• Remove image-size (no patched npm release); JPEG/PNG/WebP-only dimension parser
• sanitize-html 2.17.5, PostCSS 8.5.23, brace-expansion 5.0.9
• Linear markup scan instead of polynomial regexes
• Strip control characters from CSP and Stripe log lines
• Ignore cursor/** in the feature-to-dev auto-PR workflow

Review follow-up (b4aa605)

• Reject slash-separated handlers (<div/onmouseover=…>), matching the old \bon word boundary
• CSP logs strip C0 controls, DEL, and Unicode line separators (CodeQL log-injection)
• Stripe membership-grant failures log a sanitized name: message, not only Error

  

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

sites/mainweb/package.json

Package	Version	License	Issue Type
sanitize-html	^2.17.5	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/sanitize-html	2.17.5	🟢 6.4	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License ⚠️ 0 license file not detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 9 security policy file detected Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
npm/brace-expansion	5.0.9	🟢 7.2	Details Check Score Reason Code-Review 🟢 3 Found 6/16 approved changesets -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 24 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/sanitize-html	2.17.5	🟢 6.4	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License ⚠️ 0 license file not detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 9 security policy file detected Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
npm/postcss	8.5.23	🟢 7.4	Details Check Score Reason Code-Review 🟢 3 Found 9/30 approved changesets -- score normalized to 3 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/postcss	8.5.23	🟢 7.4	Details Check Score Reason Code-Review 🟢 3 Found 9/30 approved changesets -- score normalized to 3 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/sanitize-html	^2.17.5	Unknown	Unknown
npm/postcss	8.5.23	🟢 7.4	Details Check Score Reason Code-Review 🟢 3 Found 9/30 approved changesets -- score normalized to 3 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• packages/api/package.json
• pnpm-lock.yaml
• sites/hacklytics2027/package.json
• sites/mainweb/package.json
• tooling/tailwind/package.json

[github-actions]

Visit the preview URL for this PR (updated for commit b4aa605):

https://hacklytics2027--pr-355-hfqp9dia.web.app

_{(expires Sun, 23 Aug 2026 16:05:44 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: c48ba34db61581e25fe2978355160b5eefe0e83f}

[greptile-apps]

Greptile Summary

The PR adds comprehensive repository documentation and addresses dependency and static-analysis alerts.

• Replaces the vulnerable image-dimension dependency with a bounded JPEG, PNG, and WebP parser.
• Reworks markup scanning to avoid polynomial regex behavior and now detects slash-separated inline handlers.
• Updates affected dependencies, sanitizes security-related log lines, and adjusts branch automation.

Confidence Score: 5/5

The PR appears safe to merge because the previously reported handler-boundary bypass is fixed and no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/api/src/trpc.ts	The revised boundary check now treats slash separators correctly and closes the previously reported sanitizer bypass.
packages/api/src/.internal-tests/security.test.ts	Adds focused regression coverage for slash-separated onmouseover and onload handlers.
packages/api/src/services/image-dimensions.ts	Introduces a bounded parser for the three supported profile-image formats instead of the vulnerable dependency.
pnpm-lock.yaml	Records the dependency removals and patched package resolutions associated with the security updates.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[tRPC input] --> B[scrubMarkup]
  B --> C[hasDangerousMarkup]
  C --> D{Inline handler found?}
  D -->|Yes| E[Reject request]
  D -->|No| F[Continue procedure]

Loading

_{Reviews (2): Last reviewed commit: "Address PR review: handler scan, CSP log..." | Re-trigger Greptile}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 76a8ad5. Configure here.}