Week 39 · Sep 19–25
Week 39 (2026-09-19 to 2026-09-25) was focused on stability and security for the ship-and-shout repository.
We pushed 81 commits and merged 17 PRs.
The most significant fix addressed a dead-end in the App installation process. Previously, if the state cookie expired during the flow, users would get stuck. This is now resolved, ensuring the install completes successfully regardless of timing.
Security was the second priority. We enforced the use of restricted Stripe keys to minimize risk. Additionally, the GitHub App connection is now strictly read-only, reducing the attack surface. We also fixed a bug in the billing popup that was causing issues for some users.
On the community side, we added a stable /discord redirect. This ensures the community invite link remains consistent and easy to share.
Finally, we cleaned up the landing page. We removed claims that were misleading and explicitly labeled the example maker as fictional. Honesty in product representation matters, and this change aligns the site with that standard.
Next week will likely focus on testing these security changes in production to ensure no regressions occur.
