Shipped in PR #280, released via #281 (master b87893a, both Railway services deployed, rollout probed clean). /users now works for normal vendor owners: the platform-admin account-request fetch…
Migration 0032 applied on prod (2026-08-20 evening): alembic_version now 0032_vendor_lookup_indexes; all five indexes verified present (ix_products_vendor_id / tcgplayer_product_id / card_number /…
Shipped in PR #278, released to prod via #279 (master d4050df, both Railway services deployed, /api/public/card probed 200). Migration 0032_vendor_lookup_indexes adds products (vendor_id,…
Step 0 shipped in PR #278 / released via #279: import spreadsheets are hard-404'd on /uploads and /media (path-normalized guard; review-found // and %2E bypasses fixed and pinned in tests). Issue…
Shipped in PR #278, released to prod via #279 (master d4050df, both Railway services deployed, /api/public/card probed 200). CORS is now an explicit first-party allowlist (www.rungambit.com,…
Shipped in PR #278, released to prod via #279 (master d4050df, both Railway services deployed, /api/public/card probed 200). Vision + graded-comp endpoints capped 30/min per VENDOR (Redis-backed,…
Severity upgrade — verified from the auditor's 8/19 disaster-scenarios companion (scenario 4, Route A). This is worse than first assessed:
- Vendor import spreadsheets (cost basis, full…
Addition from the auditor's 8/19 disaster-scenarios doc (scenario 5), verified: routes/beta_signups.py:38 has its own private in-memory limiter (_recent_by_ip: dict) predating the Redis…
Addition from the auditor's 8/19 disaster-scenarios doc (scenario 5 sidebar), verified in code: the authenticated scan endpoints accept uploads up to 2 GB (config.py:174 `scan_max_upload_…