- workouts/batch + safeJson: the body cap is a DoS ceiling, not a bound
the worst-case payload always fits under; an extreme GPS-heavy backlog
can exceed it and falls back to smaller batches client-side. Note that
request.text() still buffers the raw body, so the cap bounds the parse
cost, not the initial read.
- .dockerignore: keep LICENSE / LICENSE.md in the image — AGPL-3.0
conveys with the software.
- reminder-worker: the dense walk flag is an operator kill-switch now
that the fold is reworked, not a pending-rework gate.
BuildKit walks the working tree (not the git index), so files like a
local `.env`, `.planning/`, `coverage/`, the e2e Playwright
`storageState.json`, captured HARs, and `.git/` history were all shipped
into the build cache by default. The runner stage doesn't COPY any of
them into the final image, but they sit in the builder layer cache and
leak through any operation that reads cache layers (e.g. `docker save`).
The list mirrors `.gitignore` for the entries that matter, plus the
scratch directories that live in the working tree but aren't version
controlled. `.env.example` and `.env.production.example` stay explicitly
allowed so the documented self-host bootstrap keeps working.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Marc-André Bombeck