Security hardening — round 11: 9 confirmed defects - #21

Merged

REPPL merged 10 commits into

mainfrom

security-hunt/round-11

Aug 16, 2026

Commits on Aug 16, 2026

fix: dedupe entities by declared id on the index-driven loader path
claude
committed
0f2b339
fix: coerce untrusted myVerdict so EditForm save cannot silently no-op
claude
committed
044bfc7
fix: honour the Competing auto-advance setting in RoundResultOverlay
claude
committed
ba840a0
fix: cancel superseded discovery scans and pair sources with their scanned username
claude
committed
ae4dcff
fix: remember every source whose collection defaults were applied
claude
committed
a10985b
fix: validate source health against the real collection definition schema
claude
committed
ed5c4cc
fix: unbias quiz answer order and make a flawless run score 100%
claude
committed
cc6301a
fix: bound the quiz similarity scan over untrusted card data
claude
committed
67897f6
docs: record round 11 decisions
claude
committed
8303897
test: make the similar-distractor preference assertion deterministic
claude
committed
b8a54c4