[ralyodio]

Phase 2 of the pwamart badge rollout: installer.pairux.com never had the fleet footer (its / was JSON only).

• GET / with Accept: text/html (browsers, crawlers, the rssamplifier ring verifier) returns a small landing page: install commands for macOS/Linux and Windows, release links, and the server-rendered @profullstack/footer (clearnet template: webring row, built.indie badge, pwamart badge). Vary: Accept.
• Everything else (curl, scripts, Accept: application/json) gets the same JSON as before. /api/, /install., /download/* unchanged.
• New /.well-known/openwebring.json (ring member slug installer-pairux-com).
• No CSP on this service, so both badge hosts load.

Tested: tsc clean, prettier clean; local run shows ring/built.indie/pwamart links in the HTML, JSON for curl, /health and openwebring.json OK.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​footer@​0.2.4 ⏵ 0.2.6	+4		+1	+1

View full report

[github-actions]

ThreatCrush Security Scan

48 finding(s)

HIGH/CRITICAL: 4 | MEDIUM: 28 | LOW: 16

Severity	Rule	Location
HIGH	sh-eval-expansion	.githooks/pre-commit:33
HIGH	js-electron-node-integration	apps/desktop/src/main/window.ts:49
HIGH	sh-unquoted-expansion-destructive	apps/installer/scripts/install.sh:717
HIGH	sh-unquoted-expansion-destructive	apps/installer/scripts/install.sh:919
MEDIUM	sh-remote-script-execution	apps/installer/scripts/install.sh:693
MEDIUM	sh-remote-script-execution	apps/installer/scripts/install.sh:822
MEDIUM	sh-remote-script-execution	apps/installer/scripts/install.sh:824
MEDIUM	sh-remote-script-execution	apps/installer/scripts/install.sh:1080
MEDIUM	sh-remote-script-execution	apps/installer/scripts/install.sh:1082
MEDIUM	sh-remote-script-execution	apps/livekit/setup-livekit-server.sh:93
MEDIUM	sh-remote-script-execution	apps/turn/deploy-droplet.sh:62
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:52
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:79
MEDIUM	js-unescaped-html-sink	apps/web/src/app/c/[handle]/page.tsx:199
MEDIUM	js-open-redirect	apps/web/src/app/cli/authorize/consent.tsx:68
MEDIUM	js-unescaped-html-sink	apps/web/src/app/l/[joinCode]/page.tsx:146
MEDIUM	js-unescaped-html-sink	apps/web/src/app/l/[joinCode]/page.tsx:230
MEDIUM	js-unescaped-html-sink	apps/web/src/app/layout.tsx:150
MEDIUM	js-unescaped-html-sink	apps/web/src/app/live/page.tsx:154
MEDIUM	js-unescaped-html-sink	apps/web/src/app/page.tsx:98
MEDIUM	js-unescaped-html-sink	apps/web/src/app/pricing/page.tsx:262
MEDIUM	js-unescaped-html-sink	apps/web/src/app/u/[username]/page.tsx:285
MEDIUM	js-open-redirect	apps/web/src/components/billing/useCheckout.ts:81
MEDIUM	js-unescaped-html-sink	apps/web/src/components/pit-footer.tsx:24
MEDIUM	js-open-redirect	apps/web/src/hooks/useDesktopHandoff.ts:24
MEDIUM	redos-nested-quantifier	apps/web/src/lib/deliverable.ts:11
MEDIUM	js-unescaped-html-sink	apps/web/src/lib/player/player.ts:124
MEDIUM	js-unescaped-html-sink	apps/web/src/lib/player/player.ts:393
MEDIUM	js-unescaped-html-sink	apps/web/src/lib/player/player.ts:396
MEDIUM	js-unescaped-html-sink	apps/web/src/lib/player/player.ts:405
MEDIUM	js-unescaped-html-sink	apps/web/src/lib/player/player.ts:608
MEDIUM	sql-template-interpolation	packages/ai-core/src/prompts.ts:36
LOW	secret-generic-credential	apps/desktop/src/main/agent-cli/commands.test.ts:138
LOW	secret-generic-credential	apps/desktop/src/main/agent-cli/commands.test.ts:139
LOW	secret-generic-credential	apps/desktop/src/main/agent-cli/commands.test.ts:340
LOW	secret-generic-credential	apps/desktop/src/main/agent-cli/commands.test.ts:341
LOW	secret-generic-credential	apps/desktop/src/main/agent-cli/commands.test.ts:371
LOW	secret-generic-credential	apps/desktop/src/main/agent-cli/commands.test.ts:372
LOW	secret-generic-credential	apps/desktop/src/main/agent-cli/commands.test.ts:383
LOW	secret-generic-credential	apps/desktop/src/main/agent-cli/commands.test.ts:397
LOW	secret-generic-credential	apps/desktop/src/main/agent-cli/commands.test.ts:398
LOW	secret-generic-credential	apps/desktop/src/main/agent-cli/commands.test.ts:405
LOW	secret-generic-credential	apps/desktop/src/main/agent-cli/commands.test.ts:415
LOW	secret-generic-credential	apps/desktop/src/main/agent-cli/commands.test.ts:416
LOW	secret-generic-credential	apps/livekit/fly.toml:12
LOW	secret-generic-credential	apps/turn/fly.toml:11
LOW	secret-generic-credential	docs/API.md:747
LOW	secret-generic-credential	docs/API.md:753

Snippets are redacted; ThreatCrush never prints matched credential material.