Xide is no longer developed as of 2026-11-08 (Progmasoft/xide#29), so Progmaweb stops presenting it: - product.progmasoft.com: Xide leaves the catalog, its card and its detail page; /xide on the product host is a 404 like any unknown product. The catalog's description in every language names the Tala language with its tools and Catch3. - ides.progmasoft.com served only the IDE list and the Xide page, so the whole site goes: the pages under app/ides, its texts in every language, idesRoute and its host in the proxy, and both nginx server blocks. The certificate of progmasoft.com no longer has to name it. Tests: the catalog lists the remaining products and refuses xide.
AI Support is removed and will not be published (progmaweb#59 is closed): it used every core of the second server for each answer, and it stated commands and names that are not in the documentation. The policy in every language no longer lists it among the services it covers, and the paragraph about where its questions go is gone.
The review found four promises the policies made beyond what exists: - ViGet takes no uploads from accounts yet; only Progmasoft publishes, through a server command. The Privacy Policy now says so, and that ViGet will record the IP address of each upload, for that one purpose and for the same time, once uploads open. ops/README.md tells the upload endpoint to do exactly that. - A yank leaves a JAR served by nginx and cached by Cloudflare for a year. The Security Policy says a malicious version is taken off ViGet and kept out of reach as evidence; ops/README.md gives the four steps: yank, move the JAR into a root-only quarantine, purge the Cloudflare cache, close the account. - The API cannot delete an account. ops/README.md gives the procedure support follows on a request from the account's address: a dump, then one transaction that removes the OpenIddict tokens and authorizations of the account, the applications it alone owns, and the account with its sessions and ownerships. - Pages allow Cloudflare's analytics script besides their own, and the Security Policy now names it. ops/README.md also records the nginx logs without client addresses on both servers, which make the Privacy Policy's statement about web-server logs true.
Codacy reads messages[kind] and policyUrls[kind] as object injection sinks. kind is a PolicyKind the pages pass, never input, but choosing the policy and its counterpart with one condition reads as plainly and leaves the analysis nothing to report.
progmasoft.com/privacy and progmasoft.com/security publish the two policies in en-US, de-DE, ru-RU and he-IL, and the footer links both. The Privacy Policy says what an account keeps and that Progmasoft keeps an IP address for one purpose only: with a ViGet upload, to establish where an upload that turns out to be malicious software came from and to give it to the competent authorities. It says that no data, the IP address included, is sold, rented or traded. The Security Policy covers passwords, sessions, HTTPS, the ban on malicious software in ViGet and how to report a weakness. The registration form asks the person to accept both policies, and the API refuses a registration without that acceptance, with a password (acceptPolicies, a validation error of that field) or through Google: the start of a Google registration without acceptPolicies=true goes back to /register?google=policies-required, and the completion creates no account unless the authentication state carries the current version. An account keeps the version it accepted and the moment, in two new columns that schema step 2 adds; accounts created before it keep null. PolicyAcceptance.CurrentVersion and policyVersion on the web side name the same date, and a web test reads the C# constant to keep them equal.
tazel.tala.run only redirects to tazel.net now. The product list and the Tazel plugin catalog link the new address directly.
The pages of progmasoft.com and its hosts had no content security policy. The proxy now creates a 128-bit nonce for every request and sends the policy both ways: on the request, so that Next marks its own inline scripts with the nonce, and on the response. The layout reads the nonce for the theme bootstrap. Every page is rendered on demand already, so none is served with a stale nonce. Scripts may come from the host, carry the nonce, or be Cloudflare's Web Analytics beacon from static.cloudflareinsights.com, which reports to cloudflareinsights.com. 'strict-dynamic' is left out, because browsers ignore host sources under it and the beacon is added by Cloudflare without a nonce. Styles allow inline ones; objects, framing and other base URLs are refused. There is no form-action: sign-in and OAuth consent end in redirects to other hosts, loopback addresses included, and browsers apply form-action to them. The development server also gets 'unsafe-eval' for its hot reload. Tests check the nonce and each directive; ARCHITECTURE.md describes the policy.
The sites declared no icon and /favicon.ico answered 404, so search engines and assistants that show a site's icon (DuckDuckGo, ChatGPT) fell back to a gray placeholder; the only copy of the mark was the BIMI logo for mail. The app now has the Next.js icon files, so every page links them: - app/icon.svg: the four squares of the BIMI logo, cropped to the mark so it fills a browser tab, on a transparent field. - app/favicon.ico: the same mark at 16, 32 and 48 pixels (PNG entries), for clients that ask for /favicon.ico without reading the page. - app/apple-icon.png: 180 pixels on the white field of the BIMI logo, since iOS fills transparency with black. The proxy rewrites paths per host, which would send /icon.svg on the account, ViGet and the other hosts into their own page trees; the matcher now skips the two new files as it already skipped favicon.ico, so every Progmasoft host serves the same icons.
The API of the previous commit holds the catalog; this adds what people and Tazel reach. Pages: - /dslplugins/tazel lists the published plugins, read from the API on its loopback address, and says when there is none. - /dslplugins/tazel/<Publisher>/<Name> is the page of a plugin: its description, publisher, latest version, license, authors, homepage and repository, the plugins block that uses it, and every version with its date, plugin API, size, SHA-256, yanked mark and JAR. - /dslplugins/gradle opens the Gradle catalog. It only lists: Gradle takes com.progmasoft.tazel.plugin from the Gradle Plugin Portal. - The availability note says that Progmasoft publishes first and every account later. Texts are in the four languages of the site. Nginx (ops/nginx/progmaweb.conf): - On viget.progmasoft.com, index.json of a plugin goes to the API and the JARs come from /srv/viget/files with immutable caching; /api/ stays closed. - maven.progmasoft.com serves /srv/maven, whose /tazel holds tazel-api. ops/README.md describes the directories, their SELinux labels, the publish and yank commands, and how a release of Tazel copies the API into the Maven repository. Tests cover the texts in every language, the plugins block, the Gradle list, and that a page asks the API only for identifiers.