My Claude Code just improved my entire code base, made it better and more secure.
This is so cool, and quite addicting.
Here's what it did, completely on its own.
Highest-impact fixes (in plain English):
1. Webhook info leak closed. The Whop Polar handlers used to echo secretPrefix, bodyStart, and the signature prefix back to anyone who probed with a bad signature — that narrows brute-force space and confirms a real secret is configured. Now diagnostics go to server logs only; the client gets a flat 401.
2. Webhook replay protection added. Signatures alone are reusable forever — Standard Webhooks spec requires a ±5-min timestamp window. Both handlers now enforce it via a shared lib/webhook-verify.ts (consolidated from two duplicated implementations).
3. Waitlist rate-limited. 5 requests per 10 minutes per IP, sliding window backed by Upstash Redis ZSETs (lib/rate-limit.ts). Previously anyone could pound /api/waitlist to exhaust your Loops API quota or pollute the contact list.
4. Waitlist email validation tightened from includes("@") to Zod's .email().max(254).trim().toLowerCase(). Catches obvious garbage and normalizes casing so the Loops dedupe path actually dedupes.
5. Site-wide security headers via next.config.mjs: HSTS (2-year, preload-eligible), X-Content-Type-Options: nosniff, X-Frame-Options: DENY frame-ancestors 'none', Referrer-Policy: strict-origin-when-cross-origin (important — prevents download-token URLs leaking via Referer), and a tight Permissions-Policy. Full CSP deliberately skipped — needs nonce-based middleware to do right.
6. MCP error sanitization. Upstream LLM errors no longer leak err.message (which can contain API-key prefixes, request IDs, internal URLs) back to the JSON-RPC caller.
7. MCP auth-check order swapped. In-memory ALLOWED_KEYS Set checked before Redis hasKey, so unauthenticated probes get rejected without a Redis round-trip.
8. ignoreBuildErrors: true removed. TypeScript now actually fails the Vercel build on type errors. Verified safe via tsc --noEmit.
9. robots.ts added disallowing /api/ and /mcp/.
10. package.json name corrected from the Vercel scaffold default.