Skip to content

feat(pwa): /privacy and /terms - #607

Merged
ralyodio merged 1 commit into
mainfrom
feat/legal-pages
Nov 11, 2026
Merged

ralyodio merged 1 commit into
mainfrom
feat/legal-pages

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Server-rendered /privacy and /terms on app.moshcode.sh (h1 Privacy Policy / Terms of Service, effective November 11, 2026) for the Claude Connectors Directory and ChatGPT apps submissions.

  • Covers moshcode.sh, app.moshcode.sh (pit + Moshpit registry) and the OAuth-only MCP server (/mcp and moshcode.sh/api/v1/mcp/, scoped tools, audit log, request logging, nothing sold).
  • Brand shell + footer; Privacy and Terms added to the app footer. moshcode.sh serves the same text (separate PR in moshcoder/moshcode.sh).
  • test/legal-pages.test.mjs.

Local: apps/pwa node --test, 835 pass, 0 fail.

🤖 Generated with Claude Code

Server-rendered Privacy Policy and Terms of Service in the brand shell,
covering moshcode.sh, app.moshcode.sh (pit and Moshpit included) and
the OAuth-only MCP server. The same text is served on moshcode.sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

0 finding(s) in the 5 file(s) this pull request changes.

Nothing in the files this pull request changes.

125 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 87 | **LOW**: 30

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:76
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:87
HIGH sh-remote-script-execution install.sh:91
HIGH sh-remote-script-execution install.sh:259
HIGH sh-remote-script-execution install.sh:270
HIGH sh-remote-script-execution install.sh:276
HIGH tls-verification-disabled src/dns.mjs:823
MEDIUM js-unescaped-html-sink apps/pwa/public/herd/herd.js:117
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:56
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:117
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:140
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:154
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:180
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:374
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:378
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:423
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:707
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:909
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:911

…and 105 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 9abae31 into main Nov 11, 2026
7 checks passed
@ralyodio
ralyodio deleted the feat/legal-pages branch November 11, 2026 13:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant