Rate-limit sign-in by visitor behind Cloudflare and stop forwarding h2c
Remove Xide and ides.progmasoft.com
Cloudflare proxies the Progmasoft hosts, so Nginx saw a Cloudflare edge as its peer and appended that edge to X-Forwarded-For. The API takes the last hop as the client, so the account-auth limit (12 attempts in 3 minutes) was counted per edge: 38 failed sign-ins from one address in a row were all answered with 401, none with 429, and unrelated visitors behind one edge shared a bucket. - ops/nginx/cloudflare-real-ip.conf trusts CF-Connecting-IP only from the published Cloudflare ranges; a direct peer keeps its own address, so the header cannot be forged around Cloudflare. With it installed the 13th failed sign-in gets 429, a forged X-Forwarded-For changes nothing, and another address is not affected. - Every proxied location forwarded the client's Upgrade header with "Connection: upgrade" on each request. Only a WebSocket upgrade is now forwarded; other requests carry no Upgrade and an empty Connection. - c8 reached glob 13 (GHSA-3g3m-2fjr-6pw4) and minimatch 10 (GHSA-g3hv-75wg-m249) through test-exclude; both are overridden to the fixed majors. pnpm audit reports nothing, coverage, lint and check pass. - The CodeQL action pins carry their exact version comment (v4.38.2). - ops/README.md describes the address handling and no longer names a script that left the repository with AI Support. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Xide is no longer developed as of 2026-11-08 (Progmasoft/xide#29), so Progmaweb stops presenting it: - product.progmasoft.com: Xide leaves the catalog, its card and its detail page; /xide on the product host is a 404 like any unknown product. The catalog's description in every language names the Tala language with its tools and Catch3. - ides.progmasoft.com served only the IDE list and the Xide page, so the whole site goes: the pages under app/ides, its texts in every language, idesRoute and its host in the proxy, and both nginx server blocks. The certificate of progmasoft.com no longer has to name it. Tests: the catalog lists the remaining products and refuses xide.
Ask for the Privacy and Security Policies at registration
AI Support is removed and will not be published (progmaweb#59 is closed): it used every core of the second server for each answer, and it stated commands and names that are not in the documentation. The policy in every language no longer lists it among the services it covers, and the paragraph about where its questions go is gone.
Link Tazel's site at tazel.net
The review found four promises the policies made beyond what exists: - ViGet takes no uploads from accounts yet; only Progmasoft publishes, through a server command. The Privacy Policy now says so, and that ViGet will record the IP address of each upload, for that one purpose and for the same time, once uploads open. ops/README.md tells the upload endpoint to do exactly that. - A yank leaves a JAR served by nginx and cached by Cloudflare for a year. The Security Policy says a malicious version is taken off ViGet and kept out of reach as evidence; ops/README.md gives the four steps: yank, move the JAR into a root-only quarantine, purge the Cloudflare cache, close the account. - The API cannot delete an account. ops/README.md gives the procedure support follows on a request from the account's address: a dump, then one transaction that removes the OpenIddict tokens and authorizations of the account, the applications it alone owns, and the account with its sessions and ownerships. - Pages allow Cloudflare's analytics script besides their own, and the Security Policy now names it. ops/README.md also records the nginx logs without client addresses on both servers, which make the Privacy Policy's statement about web-server logs true.