Harden public routing and production security

[DevCalebR]

Summary

• make public CTA and auth routing intentional for logged-out visitors, signed-in owners, and founder/admin pilot setup
• add a dedicated public pilot entrypoint plus clear Create account / Sign in / Start Free Pilot messaging across the public site
• harden authenticated mutations and production logging with same-origin checks, sanitized Twilio/app logs, and production CSP headers
• add regression coverage for public routing, admin/auth boundaries, webhook rejection, CSP headers, tenant-isolation wiring, and log sanitization

Validation

• npm run typecheck
• npm run lint
• npm test
• npm run build

Remaining risks

• the public simulator still depends on explicit environment flags and a dedicated simulator business; it is safer now, but it remains an intentionally separate demo surface
• the CSP is conservative but still allows Clerk and Stripe inline/script requirements; future third-party embeds will need to be added deliberately

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
callbackcloser	Ready	Preview, Comment	May 25, 2026 6:27pm