- cipher: use the already-available ctx parameter for DynamoDB Put
- goog: use context.Background for OAuth token refresh callback since
it runs asynchronously outside any request lifecycle
The Tries counter on login and registration sessions was checked but
never incremented, making the brute-force protection dead code. An
attacker could retry verification codes indefinitely within the session
TTL. Now each failed attempt increments and persists the counter.
- Guard checkoutSession.Customer access with nil checks to prevent panic
when Stripe sends incomplete checkout session data
- Switch worker migration goroutines from request ctx to context.Background()
since these operations outlive the webhook HTTP request and would be
cancelled prematurely when the response completes
Increase warmup subjects from 5 to 20 and conversations from 3 to 12
to reduce repetition patterns that spam filters can detect. New themes
cover industry, tools, networking, feedback, planning, reading, travel,
wellness, and events.
- Replace all fmt.Printf calls in Kafka consumer/producer, tracking consumer,
and user email task with structured zerolog (log.Warn/Error/Info)
- Fix hashURL using SHA-256 instead of naive first-8-chars+length approach
which was collision-prone for deduplication
- Return actual captcha verification errors instead of generic
internal errors in login, registration, and reset password flows
- Fix Sentry capturing wrong variable (err -> xerr) in
RegistrationConfirm
- Pass AuthSecret as []byte to JWT SignedString/keyfunc
- Send form data in request body instead of PostForm for Turnstile
- Improve Turnstile non-200 error handling with response body logging
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Matthew Meszaros
