- /articles with tag filter, search, popular sort, featured lead and tag index
- Reading page with byline, cover, share links (incl. WhatsApp), author card,
  likes, comments and related articles; schema.org Article data
- Shared create/edit form: tags (max 4), cover (https only), Markdown editor,
  publish or save as draft; drafts visible to their author and moderators only
- Moderators can feature articles; views counted once per session

- Forum: channels, status filters (unanswered/unsolved/solved), search,
  accepted solutions, pinned and locked threads, similar questions
- Discussions: tags, sorts, participants, pinned and locked conversations
- Owner/moderator authorization on every mutation, views once per session

- Members directory and public /@username profiles with stats and tabs
- Dashboard: drafts, questions awaiting a solution, activity on my content
- Settings: profile, password, account deletion
- Admin (moderators/admins): overview, member roles and bans, tags and
  forum channels management

- Dockerfile (multi-stage, Node 24), docker-compose with PostgreSQL 18,
  entrypoint running migrations and idempotent seeders, /up health check
- Caddy config and deploy script for staging.javascript.cm; GitHub Actions
  workflow: typecheck, tests, build, then SSH deploy on the staging branch
- Production CSP with nonce, trusted proxy for real client IPs, relaxed
  rate limits outside production, banned members signed out everywhere
- Shared reply infrastructure (edit, delete, like) and UI components
- About and code of conduct pages; SSR serializes page props like the client
- Unit and functional tests (auth, CSRF, XSS, articles, forum)
- ESLint config tuned to the project conventions; README rewritten

From a security review of the new code:
- Render markdown in a worker thread with a 5 s budget, and reject bodies
  saturated with emphasis markers up front: some inputs make CommonMark
  parsing quadratic and could freeze the server for tens of seconds
- Make excerpt and reading-time helpers linear (truncate first, bounded
  patterns, line-based code fence stripping); they run on every page view
- Only auto-link a GitHub login to an existing account whose e-mail is
  verified; GitHub-created accounts are verified, changing the e-mail
  clears the verification
- Never write multipart bodies to disk (no upload feature), cap request
  bodies at 1 MB in Caddy
- Rate-limit edits, likes, solutions, pin/lock, settings and the preview
- Hide comments of unpublished articles from profiles and the dashboard;
  only the author can publish their draft
- Count replies correctly under concurrent deletes; double-clicking a like
  no longer returns a 500
- CI deploy job is skipped with a warning when secrets are not configured

- Moderators can edit or delete members' content, never other staff
  members' (admins keep full rights); drafts stay visible to the staff
- Changing the password bumps a per-user session version: sessions opened
  before the change are signed out on their next request

- Authors and earlier participants are notified of new replies, article
  authors and commenters of new comments, answerers when their reply is
  accepted; unread notifications on the same subject are coalesced
- /notifications grouped by recency, links land on the exact reply and
  mark it read; opening the content also reads its notifications
- Unread badge on the bell and in the member workspace; ace command to
  prune old read notifications

- Members report questions, discussions, articles and replies (spam,
  abuse, off-topic, other); one open report per member and content,
  enforced by a partial unique index
- /admin/signalements groups reports by content with resolve, dismiss and
  delete actions respecting staff ranks; history survives deletion thanks
  to target snapshots

- Staff see the open reports count in every admin page
- Each flash toast gets its own id so a new one is not dismissed with the
  previous one
- Destructive menu items are red as intended