Bang-isme/CodexAI---Skills

"author": {     "name": "Bang Isme",     "url": "https://github.com/Bang-isme"

"name": "Bang Isme",     "url": "https://github.com/Bang-isme"   },

"url": "https://github.com/Bang-isme"

},   "homepage": "https://github.com/Bang-isme/CodexAI---Skills",   "repository": "https://github.com/Bang-isme/CodexAI---Skills",

"homepage": "https://github.com/Bang-isme/CodexAI---Skills",

"repository": "https://github.com/Bang-isme/CodexAI---Skills",

#!/usr/bin/env python3

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

[Credential-related source omitted]

<svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" fill="currentColor" viewBox="0 0 20 20">

Apache License                            Version 2.0, January 2004                         http://www.apache.org/licenses/

http://www.apache.org/licenses/

http://www.apache.org/licenses/LICENSE-2.0

description: "GitHub MCP server"       transport: "streamable_http"       url: "https://api.githubcopilot.com/mcp/"

url: "https://api.githubcopilot.com/mcp/"

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

Apache License Version 2.0, January 2004 http://www.apache.org/licenses/

http://www.apache.org/licenses/

http://www.apache.org/licenses/LICENSE-2.0

sudo apt-get install -y libreoffice poppler-utils

<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16">

Executable file

xml = zf.read("word/document.xml")     root = ET.fromstring(xml)     ns = {"w": "http://schemas.openxmlformats.org/wordprocessingml/2006/main"}

ns = {"w": "http://schemas.openxmlformats.org/wordprocessingml/2006/main"}

w_twips_str = pg_sz.get(         "{http://schemas.openxmlformats.org/wordprocessingml/2006/main}w"

"{http://schemas.openxmlformats.org/wordprocessingml/2006/main}w"

) or pg_sz.get("w")     h_twips_str = pg_sz.get(         "{http://schemas.openxmlformats.org/wordprocessingml/2006/main}h"

h_twips_str = pg_sz.get(         "{http://schemas.openxmlformats.org/wordprocessingml/2006/main}h"     ) or pg_sz.get("h")

"{http://schemas.openxmlformats.org/wordprocessingml/2006/main}h"

[Credential-related source omitted]

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

// Frontend consumption const consumeStream = async (message, onChunk) => {   const response = await fetch(`/api/chat/stream?message=${encodeURIComponent(message)}`);

const consumeStream = async (message, onChunk) => {   const response = await fetch(`/api/chat/stream?message=${encodeURIComponent(message)}`);   const reader = response.body.getReader();

const response = await fetch(`/api/chat/stream?message=${encodeURIComponent(message)}`);

},     servers: [       { url: 'http://localhost:3000', description: 'Development' },

servers: [       { url: 'http://localhost:3000', description: 'Development' },       { url: 'https://api.example.com', description: 'Production' },

{ url: 'http://localhost:3000', description: 'Development' },

{ url: 'https://api.example.com', description: 'Production' },

app.use('/api/users', authenticate, createProxyMiddleware({   target: 'http://user-service:3001',

target: 'http://user-service:3001',

app.use('/api/orders', authenticate, createProxyMiddleware({   target: 'http://order-service:3002',

target: 'http://order-service:3002',

[Credential-related source omitted]

USER appuser EXPOSE 3000 HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD wget -qO- http://localhost:3000/health || exit 1

EXPOSE 3000 HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD wget -qO- http://localhost:3000/health || exit 1 CMD ["node", "dist/server.js"]

HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD wget -qO- http://localhost:3000/health || exit 1

HEALTHCHECK --interval=15s --timeout=3s --start-period=10s --retries=3 \   CMD wget -qO- http://127.0.0.1:3000/health/live || exit 1

CMD wget -qO- http://127.0.0.1:3000/health/live || exit 1

const client = axios.create({   baseURL: 'https://api.service.com/v1',

baseURL: 'https://api.service.com/v1',

[Credential-related source omitted]

{   "$schema": "https://turbo.build/schema.json",

"$schema": "https://turbo.build/schema.json",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

self.addEventListener('fetch', (event) => {   event.respondWith(     caches.match(event.request).then((cached) => cached || fetch(event.request))

event.respondWith(     caches.match(event.request).then((cached) => cached || fetch(event.request))   );

caches.match(event.request).then((cached) => cached || fetch(event.request))

if (event.request.url.includes('/api/')) {     event.respondWith(       fetch(event.request)

event.respondWith(       fetch(event.request)         .then((response) => {

fetch(event.request)

caches.open('swr-v1').then((cache) =>       cache.match(event.request).then((cached) => {         const fetchPromise = fetch(event.request).then((response) => {

cache.match(event.request).then((cached) => {         const fetchPromise = fetch(event.request).then((response) => {           cache.put(event.request, response.clone());

const fetchPromise = fetch(event.request).then((response) => {

const pending = await db.getAll('pending-orders'); for (const order of pending) {   await fetch('/api/orders', { method: 'POST', body: JSON.stringify(order) });

for (const order of pending) {   await fetch('/api/orders', { method: 'POST', body: JSON.stringify(order) });   await db.delete('pending-orders', order.id);

await fetch('/api/orders', { method: 'POST', body: JSON.stringify(order) });

[Credential-related source omitted]

<!-- Always specify Vietnamese subset --> <link href="https://fonts.googleapis.com/css2?family=Be+Vietnam+Pro:wght@300;400;500;600;700&display=swap&subset=vietnamese" rel="stylesheet">

<link href="https://fonts.googleapis.com/css2?family=Be+Vietnam+Pro:wght@300;400;500;600;700&display=swap&subset=vietnamese" rel="stylesheet">

<meta charset="UTF-8">   <meta name="description" content="Mô tả trang bằng tiếng Việt">   <link rel="alternate" hreflang="vi" href="https://example.com/vi/">

<meta name="description" content="Mô tả trang bằng tiếng Việt">   <link rel="alternate" hreflang="vi" href="https://example.com/vi/">   <link rel="alternate" hreflang="en" href="https://example.com/en/">

<link rel="alternate" hreflang="vi" href="https://example.com/vi/">

<link rel="alternate" hreflang="en" href="https://example.com/en/">

// ✅ GOOD: Explicit allowlist with credentials const allowedOrigins = [   'https://app.example.com',

const allowedOrigins = [   'https://app.example.com',   'https://admin.example.com',

'https://app.example.com',

'https://admin.example.com',

defaultSrc: ["'self'"],       scriptSrc: ["'self'"],                          // No inline scripts       styleSrc: ["'self'", 'https://fonts.googleapis.com'],

scriptSrc: ["'self'"],                          // No inline scripts       styleSrc: ["'self'", 'https://fonts.googleapis.com'],       fontSrc: ["'self'", 'https://fonts.gstatic.com'],

styleSrc: ["'self'", 'https://fonts.googleapis.com'],

fontSrc: ["'self'", 'https://fonts.gstatic.com'],

imgSrc: ["'self'", 'data:', 'https:'],          // Allow data URIs for inline images       connectSrc: ["'self'", 'https://api.example.com'],       frameSrc: ["'none'"],                            // No iframes

connectSrc: ["'self'", 'https://api.example.com'],

exec(`git log --author="${username}"`);

| `eval()` with user input | Remote code execution | Never use eval |

JWT_ACCESS_TTL=15m JWT_REFRESH_TTL=7d CORS_ORIGIN=http://localhost:5173

JWT_REFRESH_TTL=7d CORS_ORIGIN=http://localhost:5173 LOG_LEVEL=info

CORS_ORIGIN=http://localhost:5173

Executable file

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Executable file

Executable file

[Credential-related source omitted]

Executable file

Executable file

Executable file

[Credential-related source omitted]

Executable file

listen 80;     server_name example.com;     return 301 https://$host$request_uri;

server_name example.com;     return 301 https://$host$request_uri; }

return 301 https://$host$request_uri;

location /api/ {         limit_req zone=api burst=20 nodelay;         proxy_pass http://app_backend;

limit_req zone=api burst=20 nodelay;         proxy_pass http://app_backend;         proxy_http_version 1.1;

proxy_pass http://app_backend;

location /api/v1/auth/ {         limit_req zone=login burst=3 nodelay;         proxy_pass http://app_backend;

limit_req zone=login burst=3 nodelay;         proxy_pass http://app_backend;         proxy_set_header Host $host;

proxy_pass http://app_backend;

location /health/ {         access_log off;         proxy_pass http://app_backend;

access_log off;         proxy_pass http://app_backend;     }

proxy_pass http://app_backend;

Executable file

Executable file

Executable file

Executable file

},     servers: [       { url: 'http://localhost:3000', description: 'Local Development' },

servers: [       { url: 'http://localhost:3000', description: 'Local Development' },     ],

{ url: 'http://localhost:3000', description: 'Local Development' },

Executable file

Executable file

[Credential-related source omitted]

- Running target URL (example: `http://localhost:3000`)

- `python "<SKILLS_ROOT>\codex-execution-quality-gate\scripts\lighthouse_audit.py" --url <http://localhost:3000> --device mobile --runs 1`

`python "<SKILLS_ROOT>\codex-execution-quality-gate\scripts\playwright_runner.py" --project-root <path> --mode check` - Generate skeleton:   `python "<SKILLS_ROOT>\codex-execution-quality-gate\scripts\playwright_runner.py" --project-root <p

- Generate skeleton:   `python "<SKILLS_ROOT>\codex-execution-quality-gate\scripts\playwright_runner.py" --project-root <path> --mode generate --url <http://localhost:3000/page>` - Run tests:

`python "<SKILLS_ROOT>\codex-execution-quality-gate\scripts\playwright_runner.py" --project-root <path> --mode generate --url <http://localhost:3000/page>`

- `python "<SKILLS_ROOT>\codex-execution-quality-gate\scripts\with_server.py" --help` - Example:   `python "<SKILLS_ROOT>\codex-execution-quality-gate\scripts\with_server.py" --server "npm run dev" --port 3000 -- python "<SKILLS_ROOT>\codex

`python "<SKILLS_ROOT>\codex-execution-quality-gate\scripts\with_server.py" --server "npm run dev" --port 3000 -- python "<SKILLS_ROOT>\codex-execution-quality-gate\scripts\lighthouse_audit.py" --url http://localhost:3000`

#!/usr/bin/env python3

Executable file

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

START_MARKER = "# >>> CODEXAI QUALITY GATE START >>>" END_MARKER = "# <<< CODEXAI QUALITY GATE END <<<" SKILLS_REPO_URL = "https://github.com/Bang-isme/CodexAI---Skills.git"

SKILLS_REPO_URL = "https://github.com/Bang-isme/CodexAI---Skills.git"

#!/usr/bin/env python3

#!/usr/bin/env python3

"  python lighthouse_audit.py --url <http://localhost:3000>\n"

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

def judge_api_url() -> str:     base_url = os.environ.get("CODEX_JUDGE_BASE_URL") or os.environ.get("OPENAI_BASE_URL") or "https://api.openai.com/v1"

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

],     }     request = urllib.request.Request(

}     request = urllib.request.Request(         judge_api_url(),

request = urllib.request.Request(

[Credential-related source omitted]

)     try:         with urllib.request.urlopen(request, timeout=LLM_JUDGE_TIMEOUT_SECONDS) as response:

try:         with urllib.request.urlopen(request, timeout=LLM_JUDGE_TIMEOUT_SECONDS) as response:             raw_payload = response.read().decode("utf-8")

with urllib.request.urlopen(request, timeout=LLM_JUDGE_TIMEOUT_SECONDS) as response:

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

"status": "error",                 "message": "Mode generate requires --url.",                 "hint": "Use: --mode generate --url http://localhost:3000/path",

"message": "Mode generate requires --url.",                 "hint": "Use: --mode generate --url http://localhost:3000/path",             },

"hint": "Use: --mode generate --url http://localhost:3000/path",

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

[Credential-related source omitted]

WEBHOOK_PATTERN = re.compile(     r"https://(?:hooks\.slack\.com/services/|discord(?:app)?\.com/api/webhooks/)[^\s\"']+",

r"https://(?:hooks\.slack\.com/services/|discord(?:app)?\.com/api/webhooks/)[^\s\"']+",

EVAL_CALL_PATTERN = re.compile(r"(?<![A-Za-z0-9_.\"'$])\beval\s*\(") EXEC_CALL_PATTERN = re.compile(r"(?<![A-Za-z0-9_.\"'$])\bexec\s*\(") HTTP_PATTERN = re.compile(r"http://[^\s\"')`]+")

EXEC_CALL_PATTERN = re.compile(r"(?<![A-Za-z0-9_.\"'$])\bexec\s*\(") HTTP_PATTERN = re.compile(r"http://[^\s\"')`]+") TODO_PATTERN = re.compile(r"\b(TODO|FIXME|HACK)\b", re.IGNORECASE)

HTTP_PATTERN = re.compile(r"http://[^\s\"')`]+")

CONSOLE_PATTERN = re.compile(r"\bconsole\.(log|debug)\s*\(") PRINT_PATTERN = re.compile(r"(^|\s)print\s*\(") LOCAL_HTTP_HOSTS = ("http://localhost", "http://127.0.0.1", "http://0.0.0.0", "http://www.w3.org/", "http://schemas.")

PRINT_PATTERN = re.compile(r"(^|\s)print\s*\(") LOCAL_HTTP_HOSTS = ("http://localhost", "http://127.0.0.1", "http://0.0.0.0", "http://www.w3.org/", "http://schemas.") AWS_DOCUMENTATION_EXAMPLE_KEYS = {"AKIAIOSFODNN7EXAMPLE"}

LOCAL_HTTP_HOSTS = ("http://localhost", "http://127.0.0.1", "http://0.0.0.0", "http://www.w3.org/", "http://schemas.")

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

while (time.time() - started) < timeout:         try:             with socket.create_connection(("127.0.0.1", port), timeout=1):

try:             with socket.create_connection(("127.0.0.1", port), timeout=1):                 return True

with socket.create_connection(("127.0.0.1", port), timeout=1):

Patterns below synthesize production-safe motion ideas from [Motion](https://motion.dev/), [GSAP](https://gsap.com/), Framer sites, and loading/accessibility guidance from web.dev. Respect reduced-motion preferences before shipping any of t

Curated from current palette systems and trend boards at [Happy Hues](https://www.happyhues.co/), [Coolors](https://coolors.co/), [Realtime Colors](https://www.realtimecolors.com/), [Accessible Palette](https://accessiblepalette.com/), and 

{   "baseUrl": "http://127.0.0.1:3000",

{   "baseUrl": "http://127.0.0.1:3000",

"baseUrl": "http://127.0.0.1:3000",

"baseUrl": "http://127.0.0.1:3000",

Pairings below were cross-checked against open-source font libraries and pairing references at [Typewolf Lookbooks](https://www.typewolf.com/lookbooks), [Fontpair](https://www.fontpair.co/), [Google Fonts](https://fonts.google.com/), and Go

| Pair | Heading Font | Body Font | Import | Visual Style | Best For | Fallback Stack | | --- | --- | --- | --- | --- | --- | --- | | Modern Ledger | `Cormorant Garamond 600` (serif) | `Inter 400/500` | `https://fonts.googleapis.com/css2?fa

| --- | --- | --- | --- | --- | --- | --- | | Modern Ledger | `Cormorant Garamond 600` (serif) | `Inter 400/500` | `https://fonts.googleapis.com/css2?family=Cormorant+Garamond:wght@600;700&family=Inter:wght@400;500;600&display=swap` | elega

| Modern Ledger | `Cormorant Garamond 600` (serif) | `Inter 400/500` | `https://fonts.googleapis.com/css2?family=Cormorant+Garamond:wght@600;700&family=Inter:wght@400;500;600&display=swap` | elegant, high-contrast | luxury ecommerce, founde

| High Contrast Review | `Playfair Display 700` (serif) | `Manrope 400/500` | `https://fonts.googleapis.com/css2?family=Playfair+Display:wght@700;800&family=Manrope:wght@400;500;600&display=swap` | polished, premium | premium SaaS marketing

| Longform Journal | `Newsreader 700` (serif variable) | `Source Sans 3 400/600` | `https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,700&family=Source+Sans+3:wght@400;500;600&display=swap` | editorial, literary | blogs, p

| Soft Luxury | `Bodoni Moda 700` (serif) | `DM Sans 400/500` | `https://fonts.googleapis.com/css2?family=Bodoni+Moda:opsz,wght@6..96,700&family=DM+Sans:wght@400;500;700&display=swap` | fashion, elevated | beauty, campaigns, magazine covers

| Quiet Gallery | `Instrument Serif 400` (serif) | `Public Sans 400/500` | `https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Public+Sans:wght@400;500;600&display=swap` | artsy, restrained | galleries, portfolios, cr

| Pair | Heading Font | Body Font | Import | Visual Style | Best For | Fallback Stack | | --- | --- | --- | --- | --- | --- | --- | | Dev Console | `Space Grotesk 600/700` (sans) | `IBM Plex Sans 400/500` | `https://fonts.googleapis.com/css

| --- | --- | --- | --- | --- | --- | --- | | Dev Console | `Space Grotesk 600/700` (sans) | `IBM Plex Sans 400/500` | `https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;500;600&family=Space+Grotesk:wght@500;600;700&display=sw

| Dev Console | `Space Grotesk 600/700` (sans) | `IBM Plex Sans 400/500` | `https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;500;600&family=Space+Grotesk:wght@500;600;700&display=swap` | technical, modern | devtools, infra da

| Operator Grid | `Sora 600/700` (sans) | `Inter 400/500` | `https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&family=Sora:wght@600;700&display=swap` | crisp, product-led | AI apps, startup homepages | `"Sora", "Segoe UI", san

| Product Velocity | `Outfit 700` (sans) | `Plus Jakarta Sans 400/500` | `https://fonts.googleapis.com/css2?family=Outfit:wght@500;600;700&family=Plus+Jakarta+Sans:wght@400;500;600&display=swap` | friendly-tech, confident | onboarding, docs

| Data Signal | `Archivo 700` (sans) | `Public Sans 400/500` | `https://fonts.googleapis.com/css2?family=Archivo:wght@600;700&family=Public+Sans:wght@400;500;600&display=swap` | structured, high-density | analytics, B2B products | `"Archivo

| AI Native | `Bricolage Grotesque 700` (sans variable) | `Work Sans 400/500` | `https://fonts.googleapis.com/css2?family=Bricolage+Grotesque:opsz,wght@12..96,700&family=Work+Sans:wght@400;500;600&display=swap` | expressive, future-facing |

| Pair | Heading Font | Body Font | Import | Visual Style | Best For | Fallback Stack | | --- | --- | --- | --- | --- | --- | --- | | Rounded Ease | `Nunito 700` (rounded sans) | `DM Sans 400/500` | `https://fonts.googleapis.com/css2?family

| --- | --- | --- | --- | --- | --- | --- | | Rounded Ease | `Nunito 700` (rounded sans) | `DM Sans 400/500` | `https://fonts.googleapis.com/css2?family=DM+Sans:wght@400;500;700&family=Nunito:wght@600;700;800&display=swap` | welcoming, soft

| Rounded Ease | `Nunito 700` (rounded sans) | `DM Sans 400/500` | `https://fonts.googleapis.com/css2?family=DM+Sans:wght@400;500;700&family=Nunito:wght@600;700;800&display=swap` | welcoming, soft | consumer apps, education | `"Nunito", "Tr

| Soft Utility | `Quicksand 700` (sans) | `Source Sans 3 400/500` | `https://fonts.googleapis.com/css2?family=Quicksand:wght@600;700&family=Source+Sans+3:wght@400;500;600&display=swap` | airy, approachable | communities, wellness apps | `"Q

| Bright Community | `Rubik 600` (sans) | `Assistant 400/500` | `https://fonts.googleapis.com/css2?family=Assistant:wght@400;500;600&family=Rubik:wght@500;600;700&display=swap` | social, upbeat | marketplaces, messaging, creator tools | `"R

| Calm Marketplace | `Poppins 600` (sans) | `Manrope 400/500` | `https://fonts.googleapis.com/css2?family=Manrope:wght@400;500;600&family=Poppins:wght@500;600;700&display=swap` | clean, commercial | consumer SaaS, listings, apps | `"Poppins

| Human Touch | `Cabin 700` (sans) | `Nunito Sans 400/500` | `https://fonts.googleapis.com/css2?family=Cabin:wght@600;700&family=Nunito+Sans:wght@400;500;600&display=swap` | warm, readable | support centers, onboarding flows | `"Cabin", "He

| Pair | Heading Font | Body Font | Import | Visual Style | Best For | Fallback Stack | | --- | --- | --- | --- | --- | --- | --- | | Neutral System | `Hanken Grotesk 700` (sans) | `Inter 400/500` | `https://fonts.googleapis.com/css2?family

| --- | --- | --- | --- | --- | --- | --- | | Neutral System | `Hanken Grotesk 700` (sans) | `Inter 400/500` | `https://fonts.googleapis.com/css2?family=Hanken+Grotesk:wght@600;700&family=Inter:wght@400;500;600&display=swap` | restrained, n

| Neutral System | `Hanken Grotesk 700` (sans) | `Inter 400/500` | `https://fonts.googleapis.com/css2?family=Hanken+Grotesk:wght@600;700&family=Inter:wght@400;500;600&display=swap` | restrained, neutral | product UI, dashboards | `"Hanken G

| Grid Discipline | `Archivo 700` (sans) | `Manrope 400/500` | `https://fonts.googleapis.com/css2?family=Archivo:wght@600;700&family=Manrope:wght@400;500;600&display=swap` | compact, utilitarian | dense admin panels, data apps | `"Archivo",

| Quiet Product | `Urbanist 700` (sans) | `Public Sans 400/500` | `https://fonts.googleapis.com/css2?family=Public+Sans:wght@400;500;600&family=Urbanist:wght@600;700&display=swap` | modern, controlled | SaaS, account settings, docs | `"Urba

| Pair | Heading Font | Body Font | Import | Visual Style | Best For | Fallback Stack | | --- | --- | --- | --- | --- | --- | --- | | Creative Pulse | `Syne 700/800` (display sans) | `Inter 400/500` | `https://fonts.googleapis.com/css2?fami

| --- | --- | --- | --- | --- | --- | --- | | Creative Pulse | `Syne 700/800` (display sans) | `Inter 400/500` | `https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&family=Syne:wght@700;800&display=swap` | bold, gallery-like | 

| Creative Pulse | `Syne 700/800` (display sans) | `Inter 400/500` | `https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&family=Syne:wght@700;800&display=swap` | bold, gallery-like | studios, agencies, campaigns | `"Syne", "Ari

| Poster Studio | `Bebas Neue 400` (display sans) | `Work Sans 400/500` | `https://fonts.googleapis.com/css2?family=Bebas+Neue&family=Work+Sans:wght@400;500;600&display=swap` | poster, high-impact | event pages, launch microsites | `"Bebas 

| Expressive System | `Fraunces 600` (serif variable) | `Plus Jakarta Sans 400/500` | `https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght,SOFT@9..144,600,50&family=Plus+Jakarta+Sans:wght@400;500;600&display=swap` | artful, contempo

**License**: GSAP's current Standard License permits no-charge commercial use in websites and apps, with restrictions for competing visual animation-builder products. Check the [current terms](https://gsap.com/community/standard-license/) f

These lifecycle APIs are documented by GSAP: [matchMedia](https://gsap.com/docs/v3/GSAP/gsap.matchMedia/), [context](https://gsap.com/docs/v3/GSAP/gsap.context/), and [ScrollTrigger](https://gsap.com/docs/v3/Plugins/ScrollTrigger/).

#!/usr/bin/env python3

emit({"status": "progress", "step": "5/5", "message": "Opening GitHub GPG settings..."})     github_url = "https://github.com/settings/gpg/new"

github_url = "https://github.com/settings/gpg/new"

#!/usr/bin/env python3

{   "schema_version": "1.0",   "$schema": "https://json-schema.org/draft/2020-12/schema",

"schema_version": "1.0",   "$schema": "https://json-schema.org/draft/2020-12/schema",   "title": "Codex Project Memory Codebase Index Artifact",

"$schema": "https://json-schema.org/draft/2020-12/schema",

"name": "my-project",     "description": "E-commerce API with React frontend",     "repo": "https://github.com/user/my-project",

"description": "E-commerce API with React frontend",     "repo": "https://github.com/user/my-project",     "primary_language": "TypeScript",

"repo": "https://github.com/user/my-project",

[Credential-related source omitted]

[Credential-related source omitted]

{   "schema_version": "2.0",   "$schema": "https://json-schema.org/draft/2020-12/schema",

"schema_version": "2.0",   "$schema": "https://json-schema.org/draft/2020-12/schema",   "title": "Codex Project Memory Knowledge Graph Artifact",

"$schema": "https://json-schema.org/draft/2020-12/schema",

{   "schema_version": "2.0",   "$schema": "https://json-schema.org/draft/2020-12/schema",

"schema_version": "2.0",   "$schema": "https://json-schema.org/draft/2020-12/schema",   "title": "Codex Project Memory Knowledge Index Artifact",

"$schema": "https://json-schema.org/draft/2020-12/schema",

{   "schema_version": "2.0",   "$schema": "https://json-schema.org/draft/2020-12/schema",

"schema_version": "2.0",   "$schema": "https://json-schema.org/draft/2020-12/schema",   "title": "Codex Project Memory Tool Manifest",

"$schema": "https://json-schema.org/draft/2020-12/schema",

#!/usr/bin/env python3

"SWR": ["useSWR(", " from 'swr", ' from "swr'],     "React Query": ["@tanstack/react-query", "useQuery(", "useMutation(", "QueryClient"],     "fetch": ["fetch("],

"React Query": ["@tanstack/react-query", "useQuery(", "useMutation(", "QueryClient"],     "fetch": ["fetch("],     "custom-hooks": ["useFetch(", "useApi("],

"fetch": ["fetch("],

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

#!/usr/bin/env python3

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

Executable file

#!/usr/bin/env python3

Before: "This improves performance" After:  "Measure before/after with `curl -w '%{time_total}' /api/users`"

After:  "Measure before/after with `curl -w '%{time_total}' /api/users`"

### ✅ Specific Version > **Finding:** `GET /api/products` averages 780ms (measured: `curl -w '%{time_total}' localhost:3000/api/products` over 20 requests). The query in `src/services/product.ts:23` runs `SELECT * FROM products JOIN categ

> **Finding:** `GET /api/products` averages 780ms (measured: `curl -w '%{time_total}' localhost:3000/api/products` over 20 requests). The query in `src/services/product.ts:23` runs `SELECT * FROM products JOIN categories` on every request -

> **Risk:** Stale data for up to 60s after product update. Mitigation: explicit `cache.invalidate('products')` in write handlers. > > **Verification:** `curl -w '%{time_total}' /api/products` -> expect < 50ms on cache hit.

> > **Verification:** `curl -w '%{time_total}' /api/products` -> expect < 50ms on cache hit. >

> **Verification:** `curl -w '%{time_total}' /api/products` -> expect < 50ms on cache hit.

| Linter clean now | "`npx eslint src/` → 0 errors, 0 warnings" | Any "lint clean" claim | | Diff confirming change | "`git diff` shows exact lines changed" | Any "fixed" claim | | Runtime verification | "Started server → `curl /health` → 2

| Diff confirming change | "`git diff` shows exact lines changed" | Any "fixed" claim | | Runtime verification | "Started server → `curl /health` → 200 OK" | Any "works" claim | | Red-green test cycle | "Test failed → fix applied → test pas

| Runtime verification | "Started server → `curl /health` → 200 OK" | Any "works" claim |

| 1 | "The code looks correct" | ❌ | | 2 | "Route is registered in `routes/index.js`, handler exists" | ⚠<U+FE0F> | | 3 | "`curl -X POST /api/users -d '...' → 201 Created`" | ✅ |

| 2 | "Route is registered in `routes/index.js`, handler exists" | ⚠<U+FE0F> | | 3 | "`curl -X POST /api/users -d '...' → 201 Created`" | ✅ | | 4 | "Curl returns 201 + test passes + invalid input returns 422" | ✅ Conclusive |

| 3 | "`curl -X POST /api/users -d '...' → 201 Created`" | ✅ |

| 4 | "Curl returns 201 + test passes + invalid input returns 422" | ✅ Conclusive |

> **Decision:** Use Redis for API response caching because the current P95 response time (800ms) exceeds the 500ms target, and 70% of requests are repeated reads. > > **Evidence:** `curl -w '%{time_total}' /api/products` -> 820ms average ov

> > **Evidence:** `curl -w '%{time_total}' /api/products` -> 820ms average over 10 requests. `SELECT count(*) FROM request_log WHERE path='/api/products' AND created_at > now()-interval '1h'` -> 4,200 requests, 3,100 unique. >

> **Evidence:** `curl -w '%{time_total}' /api/products` -> 820ms average over 10 requests. `SELECT count(*) FROM request_log WHERE path='/api/products' AND created_at > now()-interval '1h'` -> 4,200 requests, 3,100 unique.

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

IDENTIFIER_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$") INJECTION_MARKERS = ("system notice", "ignore previous instructions")

IDENTIFIER_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$") INJECTION_MARKERS = ("system notice", "ignore previous instructions")

INJECTION_MARKERS = ("system notice", "ignore previous instructions")

INJECTION_MARKERS = ("system notice", "ignore previous instructions")

#!/usr/bin/env python3

#!/usr/bin/env python3

**Procedure:** 1. Revert deployment: `[exact rollback command]` 2. Verify rollback: `curl -s /health` → 200 OK, version = previous

1. Revert deployment: `[exact rollback command]` 2. Verify rollback: `curl -s /health` → 200 OK, version = previous 3. Revert database migration (if applicable): `[migration rollback command]`

2. Verify rollback: `curl -s /health` → 200 OK, version = previous

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

# 8. Health check HEALTHCHECK --interval=30s --timeout=5s --retries=3 \   CMD wget -qO- http://localhost:3000/health || exit 1

HEALTHCHECK --interval=30s --timeout=5s --retries=3    CMD wget -qO- http://localhost:3000/health || exit 1

CMD wget -qO- http://localhost:3000/health || exit 1

# ❌ Installing unnecessary tools RUN apt-get install -y vim curl wget git

RUN apt-get install -y vim curl wget git

pids: 100     healthcheck:       test: wget -qO- http://localhost:3000/health || exit 1

healthcheck:       test: wget -qO- http://localhost:3000/health || exit 1       interval: 30s

test: wget -qO- http://localhost:3000/health || exit 1

proxy_read_timeout 30s;     proxy_connect_timeout 5s;     proxy_pass http://app_backend;

proxy_connect_timeout 5s;     proxy_pass http://app_backend;   }

proxy_pass http://app_backend;

# .pre-commit-config.yaml repos:   - repo: https://github.com/pre-commit/pre-commit-hooks

repos:   - repo: https://github.com/pre-commit/pre-commit-hooks     rev: v4.5.0

- repo: https://github.com/pre-commit/pre-commit-hooks

- repo: https://github.com/Yelp/detect-secrets

- repo: https://github.com/hadolint/hadolint

- repo: https://github.com/eslint/eslint

# Deploy to staging first, then scan running application     - docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py         -t https://staging.example.com/api-docs.json

-t https://staging.example.com/api-docs.json

# Test DoH with curl curl -s 'https://1.1.1.1/dns-query?name=example.com&type=A' \

curl -s 'https://1.1.1.1/dns-query?name=example.com&type=A' \

sudo ufw default deny incoming

sudo ufw default allow outgoing

sudo ufw allow 22/tcp comment 'SSH'

sudo ufw allow 80/tcp comment 'HTTP'

sudo ufw allow 443/tcp comment 'HTTPS'

sudo ufw allow from 10.0.0.0/24 to any port 3306 comment 'MySQL from app subnet'

sudo ufw allow from 10.0.0.0/24 to any port 6379 comment 'Redis from app subnet'

sudo ufw limit 22/tcp

sudo ufw logging medium

sudo ufw enable

sudo ufw status verbose

useradd -m -G sudo -s /bin/bash admin-user

### Sudo Hardening

Defaults    logfile=/var/log/sudo.log  # Log all sudo usage

-a always,exit -F path=/usr/bin/sudo -F perm=x -k sudo_exec

| `dig` | DNS lookup/debugging | `dig +dnssec example.com` | | `netstat` / `ss` | Local port/connection listing | `ss -tlnp` | | `curl` | HTTP testing with headers | `curl -I -v https://target.com` |

| `netstat` / `ss` | Local port/connection listing | `ss -tlnp` | | `curl` | HTTP testing with headers | `curl -I -v https://target.com` | | `openssl` | SSL/TLS testing | `openssl s_client -connect host:443` |

| `curl` | HTTP testing with headers | `curl -I -v https://target.com` |

exec(`ping ${req.query.host}`);

// Attack: host = "google.com; rm -rf /"

<!-- Verify CDN scripts haven't been tampered with --> <script src="https://cdn.example.com/lib.js"

<script src="https://cdn.example.com/lib.js"

// ❌ VULNERABLE — user controls URL const response = await fetch(req.body.url);

const response = await fetch(req.body.url);

// Attack: url = "http://169.254.169.254/latest/meta-data/" (AWS metadata)

# Web vulnerability scan nikto -h https://target.com

nikto -h https://target.com

# Web directory brute force gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt

gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt

# API endpoint discovery ffuf -u https://target.com/api/FUZZ -w api-endpoints.txt

ffuf -u https://target.com/api/FUZZ -w api-endpoints.txt

# Technology fingerprinting whatweb https://target.com

whatweb https://target.com

# SQLMap (automated SQL injection) sqlmap -u "https://target.com/api/users?id=1" --dbs --batch

sqlmap -u "https://target.com/api/users?id=1" --dbs --batch

- pattern: eval(...)

-Dsonar.projectKey=myapp         -Dsonar.sources=src         -Dsonar.host.url=https://sonar.example.com

[Credential-related source omitted]

-Dsonar.host.url=https://sonar.example.com

[Credential-related source omitted]

# Baseline scan (passive — fast)     - docker run ghcr.io/zaproxy/zaproxy:stable zap-baseline.py         -t http://target:3000

-t http://target:3000

# API scan (active — comprehensive)     - docker run ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py         -t http://target:3000/api-docs.json

-t http://target:3000/api-docs.json

# Only run weekly, not on every PR     - docker run ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py         -t http://target:3000

-t http://target:3000

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

image: docker.elastic.co/kibana/kibana:8.12.0     environment:       - ELASTICSEARCH_HOSTS=http://elasticsearch:9200

environment:       - ELASTICSEARCH_HOSTS=http://elasticsearch:9200       - ELASTICSEARCH_USERNAME=kibana_system

- ELASTICSEARCH_HOSTS=http://elasticsearch:9200

"notify_slack": {       "webhook": {         "url": "https://hooks.slack.com/...",

"webhook": {         "url": "https://hooks.slack.com/...",         "body": "🚨 Brute force detected: {{ctx.payload.aggregations.by_ip.buckets.0.key}} — {{ctx.payload.aggregations.by_ip.buckets.0.doc_count}} failed logins in 5 min"

"url": "https://hooks.slack.com/...",

sudo apt install certbot python3-certbot-nginx

sudo certbot --nginx -d example.com -d www.example.com

sudo certbot renew --dry-run

sudo certbot renew

# Test your SSL configuration # Online: https://www.ssllabs.com/ssltest/

# Online: https://www.ssllabs.com/ssltest/

# .npmrc — prioritize private registry @company:registry=https://npm.company.com/

@company:registry=https://npm.company.com/

[Credential-related source omitted]

# Quick scan (passive + active) docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \   -t https://target.com \

docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py    -t https://target.com

-t https://target.com \

# Full scan (active scanning — more aggressive) docker run -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \   -t https://target.com \

docker run -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py    -t https://target.com

-t https://target.com \

# API scan (OpenAPI/Swagger) docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \   -t https://target.com/api-docs.json \

docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py    -t https://target.com/api-docs.json

-t https://target.com/api-docs.json \

Executable file

"style-src": ["'self'", "'unsafe-inline'"],     "img-src": ["'self'", "data:", "https:"],     "font-src": ["'self'", "https://fonts.gstatic.com"],

"img-src": ["'self'", "data:", "https:"],     "font-src": ["'self'", "https://fonts.gstatic.com"],     "connect-src": ["'self'"],

"font-src": ["'self'", "https://fonts.gstatic.com"],

const trustedSources = {     fonts: {       "style-src": ["https://fonts.googleapis.com"],

fonts: {       "style-src": ["https://fonts.googleapis.com"],       "font-src": ["https://fonts.gstatic.com"],

"style-src": ["https://fonts.googleapis.com"],

"font-src": ["https://fonts.gstatic.com"],

analytics: {       "script-src": [         "https://www.googletagmanager.com",

"script-src": [         "https://www.googletagmanager.com",         "https://www.google-analytics.com",

"https://www.googletagmanager.com",

"https://www.google-analytics.com",

],       "connect-src": ["https://www.google-analytics.com"],       "img-src": ["https://www.google-analytics.com"],

"connect-src": ["https://www.google-analytics.com"],

"img-src": ["https://www.google-analytics.com"],

},     stripe: {       "script-src": ["https://js.stripe.com"],

stripe: {       "script-src": ["https://js.stripe.com"],       "frame-src": ["https://js.stripe.com", "https://hooks.stripe.com"],

"script-src": ["https://js.stripe.com"],

"frame-src": ["https://js.stripe.com", "https://hooks.stripe.com"],

"connect-src": ["https://api.stripe.com"],

},     cdn: {       "script-src": ["https://cdn.jsdelivr.net", "https://unpkg.com"],

cdn: {       "script-src": ["https://cdn.jsdelivr.net", "https://unpkg.com"],       "style-src": ["https://cdn.jsdelivr.net"],

"script-src": ["https://cdn.jsdelivr.net", "https://unpkg.com"],

"style-src": ["https://cdn.jsdelivr.net"],

* Validate CSP:  * - Browser console: CSP violation reports  * - https://csp-evaluator.withgoogle.com/

* - Browser console: CSP violation reports  * - https://csp-evaluator.withgoogle.com/  * - Optional report endpoint:

* - https://csp-evaluator.withgoogle.com/

#!/bin/bash

listen [::]:80;     server_name example.com www.example.com;     return 301 https://$host$request_uri;

server_name example.com www.example.com;     return 301 https://$host$request_uri; }

return 301 https://$host$request_uri;

add_header Referrer-Policy "strict-origin-when-cross-origin" always;     add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;     add_header Content-Security-Policy "default-src 'self'; script-src 'se

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self'; frame-ance

location /api/ {         limit_req zone=api burst=20 nodelay;         proxy_pass http://app_backend;

limit_req zone=api burst=20 nodelay;         proxy_pass http://app_backend;         proxy_http_version 1.1;

proxy_pass http://app_backend;

location /api/auth/ {         limit_req zone=login burst=3 nodelay;         proxy_pass http://app_backend;

limit_req zone=login burst=3 nodelay;         proxy_pass http://app_backend;         proxy_set_header Host $host;

proxy_pass http://app_backend;

- [ ] Path traversal: `../../etc/passwd` in file path params - [ ] Command injection: `; ls -la` in text inputs - [ ] SSRF: `http://169.254.169.254/` in URL inputs

- [ ] Command injection: `; ls -la` in text inputs - [ ] SSRF: `http://169.254.169.254/` in URL inputs - [ ] Oversized payload (>1MB body) → rejected

- [ ] SSRF: `http://169.254.169.254/` in URL inputs

Executable file

uses: zaproxy/action-api-scan@v0.7.0         with:           target: http://localhost:3000/api-docs.json

with:           target: http://localhost:3000/api-docs.json           format: openapi

target: http://localhost:3000/api-docs.json

Executable file

defaultSrc: ["'self'"],         scriptSrc: ["'self'"],         styleSrc: ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],

scriptSrc: ["'self'"],         styleSrc: ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],         imgSrc: ["'self'", 'data:', 'https:'],

styleSrc: ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],

imgSrc: ["'self'", 'data:', 'https:'],         fontSrc: ["'self'", 'https://fonts.gstatic.com'],         connectSrc: ["'self'", process.env.API_URL || ''],

fontSrc: ["'self'", 'https://fonts.gstatic.com'],

* ❌ X-Powered-By               — removed (information leak)  *  * TEST: https://securityheaders.com/?q=your-site.com

*  * TEST: https://securityheaders.com/?q=your-site.com  * TARGET: Grade A+ on securityheaders.com

* TEST: https://securityheaders.com/?q=your-site.com

#!/bin/bash

[Credential-related source omitted]

# --- General --- api_addr     = "https://vault.example.com:8200"

api_addr     = "https://vault.example.com:8200"