kunthawat/sales-trainer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record reviewer-drive security fixes (mask sales_kit/report, ready-gate) in engineering log

Browse Source
This commit is contained in:
Macky
2026-08-07 16:10:02 +07:00
parent ce6076f7f4
commit eadf4f727a
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/engineering-log/2026-08-07-security-ux.md
View File

@@ -40,5 +40,13 @@ accessibility/touch/visual polish. Committed as `[verified]`.
`camo.moreminimore.com/tabs` (HTTP 500) and cannot reach localhost. Rendered verification done `camo.moreminimore.com/tabs` (HTTP 500) and cannot reach localhost. Rendered verification done
via served-HTML/DIST inspection instead. via served-HTML/DIST inspection instead.
## Independent reviewer follow-up (requesting-code-review)
Reviewer verdict: `passed: true` — zero blocking security/logic issues. It raised 2 non-blocking
(pre-existing) suggestions, both applied in `ce6076f`:
- `get_group`: now masks `sales_kit` + `report` for trainees (they contain latent pain analysis).
- `get_persona`: now gates `status==ready` for trainees (parity with `list_personas`).
- Extended `test_security.py` with latent-leak + non-ready-gate assertions; all suites still pass.
## Next ## Next
- Independent reviewer (requesting-code-review subagent) result pending → incorporate, then commit. - Set a real `LLM_API_KEY` (and provider) and run a live smoke test of analyze→personas→chat→judge.
- Push to Gitea remote (repo currently local, no remote yet); validate Docker build on EasyPanel.