Commits

main

SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026 a0a8f75
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 a675577
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0OpenVibers · 23 Sept 2026 f6b98fc
Membership card, badge and widget endpoints (roadmap §11.3): public data only, no cookies, safe to embedOpenVibers · 23 Sept 2026 fe7eaad
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026 9668a49
Consumers can gate on VIP: the product's default gate, product perks and a shared product cache with a tested convergence boundOpenVibers · 23 Sept 2026 2accbeb
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026 f7e2ef4
Events webhook requires signature v2 (replay window); openvibe-sdk v0.4.0OpenVibers · 23 Sept 2026 dc98781
Gated-resource rules are per creator and the product names the owner: POST /policies/evaluate takes owner and applies only that creator's rule (none → owner_required, a pinned rule of another creator → owner_mismatch); a creator who claims someone else's reference first no longer blocks the owner (was 409) or gates it to their own membersOpenVibers · 23 Sept 2026 797b899
nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits byOpenVibers · 23 Sept 2026 968580c
Security: checkout return URLs stay on this site; page notices are signedOpenVibers · 23 Sept 2026 07ba885
openvibe-contracts v0.19.0 (this service's manifest and capabilities are released); contracts check is blockingOpenVibers · 23 Sept 2026 9e1c219
Checkout stays closed while VIP_CHECKOUT_PROVIDERS is empty (the setting until Billing's cutover): plan pages say so, the API refuses; README: before and after the Billing cutoverOpenVibers · 23 Sept 2026 a2c630d
OpenVibe.VIP W10: plans with immutable versioned terms, perks and product bindings, Billing entitlement projection (events + inbox, valid_until, authoritative fallback), checkout and cancel through Billing, gated-resource policy that fails closed, consumer client, SSR pages, outbox events, Live offering importOpenVibers · 23 Sept 2026 29046a1
Charter: OpenVibe.VIP as defined in the OpenVibe realignment plan (placeholder, no code yet)OpenVibers · 21 Sept 2026 3ce54ff