NoSignups (FckSignups)
Operate a NoSignups fork with explicit data and submission boundaries
Review outbound tool links, runtime catalogue validation and the GitHub-writing Worker without mistaking CORS or no-signup branding for authorization.
What you will learn
- Outbound-link attributes do not validate a destination.
- Submission endpoints need controls beyond browser CORS headers.
- A parsed URL and a typed object are not complete runtime validation.
Before you start
- Basic JavaScript and JSON knowledge
- A harmless sample task and catalogue fixture
Explain the chapter boundary and verify it using the proposed fixture or review record.
Key takeaways
- Outbound-link attributes do not validate a destination.
- Submission endpoints need controls beyond browser CORS headers.
- A parsed URL and a typed object are not complete runtime validation.
Catalogue records cross a trust boundary
ToolCard opens tool.url and links tool.github. It uses noopener and noreferrer for new-tab links, which limits particular opener and referrer interactions; these attributes do not certify the destination or make its content safe. A changed domain or compromised catalogue record can still send a visitor somewhere unexpected. Review the actual destination separately from the friendly display name.
A hardened fork should validate supported HTTP or HTTPS URLs, field types, unique IDs and category references before rendering a remote record. That is a proposed control, not a feature proven in loadTools. Use harmless fixtures for validation tests. Never upload personal files to an unfamiliar linked tool just to check whether the directory’s no-account claim is accurate.
A submission form can create external state
The inspected Worker routes POST requests to submission, report or suggestion handlers. handleSubmitTool validates fields, builds a GitHub issue body and calls the issues API with a server-side token. A directory that appears read-only can therefore include a separate write path. Review where a fork’s frontend sends forms before enabling them, and test only against a repository and service you control.
corsHeaders selects an allowed browser origin for the response, while the displayed router does not itself reject an unlisted Origin before reaching a handler. CORS response headers are not a substitute for server-side authorization or abuse controls. This is source-level review of named files, not a penetration test or a claim that no additional platform protections exist on the live deployment.
Validate content and constrain credentials independently
The submission validator checks that URL strings parse, but parsing alone does not establish an approved scheme or domain. Name and description are truncated to 100 and 500 characters; category is a string rather than a checked catalogue membership in this handler. These details define what the code actually enforces and what an operator must review before trusting submissions as curated records.
Keep issue-writing credentials only in the Worker secret environment, limit their permissions to the required repository operation, and plan rotation and abuse monitoring. Treat submitted descriptions as untrusted data during human or agent-assisted review. The exercise below is a defensive checklist, not a command to contact the public endpoint; this review sent no submissions and created no issues.
Implementation steps
- 1
Inventory catalogue and form endpoints in the fork.
- 2
Validate records before rendering or accepting them.
- 3
Keep write credentials outside the frontend bundle.
- 4
Test controls with fixtures in a service and repository you own.
Copy-ready example
Read boundary: catalogue source -> validated records -> outbound links
Write boundary: reviewed form -> controlled Worker -> owned issue repository
Secret boundary: Worker environment only, never browser JavaScript
Test boundary: harmless fixtures, no public submissionsFrequently asked questions
Does an allowed-origin list authenticate a sender?
No. Browser CORS handling and server-side authorization solve different problems. Review the actual request controls and any deployment-layer protections.
Were the public submission endpoints tested?
No. The conclusions come from inspected source files. No public form was submitted and no issue was created.
Sources
- README.mdSource checked 2026-09-07
- package.jsonSource checked 2026-09-07
- vite.config.mtsSource checked 2026-09-07
- src/hooks/useTools.tsSource checked 2026-09-07
- src/components/Home/Tools/Tools.tsxSource checked 2026-09-07
- src/components/Home/Tools/ToolCard/ToolCard.tsxSource checked 2026-09-07
- src/types/index.tsSource checked 2026-09-07
- src/constants/fallbackData.tsSource checked 2026-09-07
- src/data/schema.jsSource checked 2026-09-07
- cloudflare-worker/worker.tsSource checked 2026-09-07
- cloudflare-worker/urlHandlers/handleSubmitTool.tsSource checked 2026-09-07
- cloudflare-worker/utils.tsSource checked 2026-09-07