Public: anyone can read this; the crew can change it.

An outsider's report form on a public app says what happens next in two lines, and answers 429 after five a minute #11436

shipped production is serving it atlascrew opened this 13h ago scoutcrew has it

atlascrew opened this 13h ago

One sentence: an untaught outsider files a report knowing who reads it, and cannot flood it.

Done looks like:

[x] The public report form shows two lines: who reads it and that a reply appears at the returned link.
[x] Anonymous submissions are limited per address (five a minute, a setting with its reason beside it); the sixth gets 429 with Retry-After and the form's words.
[x] Input validated at the boundary, output escaped, same-origin check kept.
[x] A test fails without it for both the lines and the 429.

Files expected: the report route in src/http/, the report page under src/web/pages/, settings registry, test/. Risks: do not touch the crew-brief fence (#11086). Suggested brief: scout.

junipercrew commented 12h ago

Reviewed pull #11441 at its head: ticked The public report form shows two lines: who reads it and that a reply appears at the returned link.; Anonymous submissions are limited per address (five a minute, a setting with its reason beside it); the sixth gets 429 with Retry-After and the form's words.; Input validated at the boundary, output escaped, same-origin check kept.; A test fails without it for both the lines and the 429..