warmbly

.well-known

feat: host the Microsoft identity association file at site/public/.well-known/microsoft-identity-association.json so warmbly.com verifies as the publisher domain for the Entra app registration that connects Outlook mailboxes (#486 )

2026-09-13 04:54:49 -07:00

backdrops

feat: remove the remaining iOS Safari GPU hogs from the index page without changing its look: the app shell's three SkyChrome cloud blurs are baked into one SVG background (public/backdrops/shell-ambient.svg, same shapes, blur radii and opacities) so fifteen shells stop running forty-five live 60-70px blur layers, .round-clip clips with clip-path instead of the translateZ + mask-image trick that forced a 3D layer and a mask buffer on all fourteen frames, a shell that scrolls off screen pauses its pings and pulses, and ?noshell, ?noanim and ?nogl query switches let a phone isolate whichever subsystem is left

2026-09-02 08:54:16 -07:00

blog

feat: add eleven 1200x600 webp blog cover images (29-59KB each) under public/blog for post grid thumbnails and social share cards

2026-07-07 07:15:06 +02:00

brand

Add steel Warmbly wordmark for theme-agnostic email signatures

2026-09-20 14:58:07 +02:00

_headers

feat: complete the ADA CASA v2.1.1 AL1 control set across authentication, sessions, access control, cryptography, input validation and configuration, adding a breached-password denylist and per-account login throttling, enforced multi-factor authentication on the admin panel, step-up confirmation before an action that mints a lasting credential, purpose-scoped session tokens, single-use TOTP steps, tenant verification on every cross-referenced identifier, security headers on every surface, encrypted webhook signing secrets, per-organization idempotency, PKCE and a minimal two-scope Gmail consent on the mailbox OAuth flow, bounded spreadsheet and archive decoding, a patched Go toolchain with govulncheck in CI, and the evidence pack under compliance/casa

2026-09-19 08:18:35 +02:00

apple-touch-icon.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

cli.ps1

fix: address the review on the CLI PR: give the sign-in handshake its own per-IP budget so a 200-poll login cannot lock the address out of the browser login, keep https for a remote host that names a port instead of sending a bearer token in cleartext, report truncation when a paginated walk stops at max-pages, accept a piped secret with no trailing newline, normalise WEBSOCKET_URL on its suffix so a bare /socket becomes a real endpoint, destroy a minted secret the moment its code expires, gate cli-installer-ci on the required status check, print a rejected flag instead of an unbound-variable error, and use a portable sha256 so the packaging runs on macOS

2026-09-04 21:03:58 -07:00

cli.sh

fix: address the review on the CLI PR: give the sign-in handshake its own per-IP budget so a 200-poll login cannot lock the address out of the browser login, keep https for a remote host that names a port instead of sending a bearer token in cleartext, report truncation when a paginated walk stops at max-pages, accept a piped secret with no trailing newline, normalise WEBSOCKET_URL on its suffix so a bare /socket becomes a real endpoint, destroy a minted secret the moment its code expires, gate cli-installer-ci on the required status check, print a rejected flag instead of an unbound-variable error, and use a portable sha256 so the packaging runs on macOS

2026-09-04 21:03:58 -07:00

cli.sh.sha256

fix: address the review on the CLI PR: give the sign-in handshake its own per-IP budget so a 200-poll login cannot lock the address out of the browser login, keep https for a remote host that names a port instead of sending a bearer token in cleartext, report truncation when a paginated walk stops at max-pages, accept a piped secret with no trailing newline, normalise WEBSOCKET_URL on its suffix so a bare /socket becomes a real endpoint, destroy a minted secret the moment its code expires, gate cli-installer-ci on the required status check, print a rejected flag instead of an unbound-variable error, and use a portable sha256 so the packaging runs on macOS

2026-09-04 21:03:58 -07:00

favicon-16x16.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

favicon-32x32.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

favicon-48x48.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

favicon-96x96.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

favicon.ico

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

install.sh

feat: send HSTS from the forms service only on FORMS_DOMAIN and strip it in the installer's Caddy block for customer-owned domains, so no customer apex is pinned to HTTPS

2026-10-04 05:19:22 -07:00

install.sh.sha256

feat: send HSTS from the forms service only on FORMS_DOMAIN and strip it in the installer's Caddy block for customer-owned domains, so no customer apex is pinned to HTTPS

2026-10-04 05:19:22 -07:00

og-image.jpg

feat: replace the marketing site's Open Graph and Twitter card with a top-left 1.91:1 crop of the new dashboard export, and derive og:image type, width and height from the real image so blog covers stop declaring 1280x640 jpeg

2026-09-19 18:45:55 +02:00

robots.txt

site: bootstrap site/ from warmbly-web (strip old content for redesign)

2026-05-25 16:29:37 +00:00

site.webmanifest

site: social avatar + full SEO icon set + Mindroot Ltd footer + home pricing restore

2026-05-27 05:19:52 +00:00

web-app-manifest-192x192.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00

web-app-manifest-512x512.png

feat: refresh app favicon assets

2026-06-04 08:55:31 +02:00