Paul Bakaus 60c860f022 Pin the token expression in the manual-edit-stash source assertion ...

Review follow-up: the regex stopped at the literal ?token= and tolerated
anything after it, so removing the encoded token value from the URL
still passed. Requiring encodeURIComponent(TOKEN) right after the
prefix makes the mutation fail.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-31 18:13:27 -07:00

23 KiB

Raw Permalink Blame History

View Raw