HollaHoop

General

Anything else.

API rate limiting and abuse hardening (platform-wide)

Generalises the per-key rate limiter already shipped in src/lib/api/rest.ts to every public ingress, not just the v1 REST endpoints. Per-IP limits on unauthenticated public surfaces (feedback submission, comments, vote, signup, login, password reset, public hub reads), per-user limits on authenticated mutations, per-project burst caps so a single noisy project cannot drown the platform, and per-org daily envelopes so a misbehaving customer cannot spike infrastructure. Implementation: a small ratelimit table keyed on (scope, identifier, window_start) backed by a Postgres advisory-lock token bucket, plus an in-memory layer for hot endpoints. Fail-closed on Supabase outage; fail-open only when the limiter itself is unhealthy. Brute-force throttling on /login and /auth/* with exponential backoff per IP and per email. Captcha challenge (hCaptcha or Turnstile) auto-injected on suspicious traffic patterns - not on every request. Strict body size limits per endpoint (e.g. post body 20kb, ticket body 200kb, attachments via the upload card only). Slow-loris timeouts. Standard 429 responses with x-ratelimit-* headers and Retry-After. Surfaces a /admin/abuse internal dashboard (Hollahoop staff only, gated by is_hollahoop_admin) showing recent 429s, top noisy IPs, and a manual block list. Audit log integration: every block/unblock recorded. Out of scope: WAF/CDN-level DDOS (handled by the deployment edge if used), full bot detection ML - this card is the deterministic safety net.

PlannedGeneral·2 months ago·0

Feature flags + Labs page (per-org and per-user beta opt-in)

Foundation that lets us ship features behind an opt-in beta toggle and graduate them when they are tested. Three small tables: feature_flags (key text PK, label, description, status enum stable|beta|internal|deprecated, default_on boolean, scope enum org|user|both, graduating_target date), org_feature_overrides (org_id, flag_key, enabled), user_feature_overrides (user_id, flag_key, enabled). Stable flags ignore overrides and are always on; internal flags are only visible to Hollahoop staff (auth metadata is_hollahoop_admin); beta flags surface in a new Labs settings page; deprecated flags show a sunset notice and refuse new opt-ins. New routes: /app/{org}/settings/labs (org owner toggles beta features for the whole org, with a per-flag "default for new members" choice) and /app/account/labs (each user toggles personal-experience flags). Code-side: useFeatureFlag(key) hook on client, isFeatureEnabled(key, {orgId, userId}) server helper, both pulling from a single in-memory registry that the build seeds from feature_flags. UI: every flag-gated screen renders a small "Beta" pill near its title pulled from the same registry, plus a one-line "this is opt-in and may change" disclaimer at the top. Cards already in the planned column (support inbox + ingestion + AI assist, team chat, live view, AI Suggest, AI moderation, GitHub integration, Twilio MFA) will register themselves with status=beta from day one and graduate to stable individually as they reach quality bar. Out of scope: percentage rollouts (50% of orgs see X), cohort-based gating, A/B experiment metrics - this is opt-in betas only, not an experimentation platform.

ShippedGeneral·2 months ago·1

UX audit batch — Jun 2026 (public portal + admin chrome)

# Hollahoop UX audit — Jun 16, 2026 Full pass as an anonymous user across localhost + production (`hollahoop.app`). ## Shipped this session - **P0** Fixed UTF-16 corrupted admin chrome (`workspace-top-bar`, `admin-top-bar`, `language-switcher`) — changelog/docs/app were 500ing - **Support inbox** Full-height collapsible filter rail (previous session) - **Roadmap list a11y** Vote/comment counts now have proper `aria-label`s - **Theme toggle** Names the *next* theme in the cycle for screen readers - **Post detail** "View on roadmap" link when status is on roadmap; softer comment composer; fewer duplicate Sign in links - **Login** Explains why sign-in is required when redirected from `/feedback/new` - **i18n** Pre-paint `document.documentElement.lang` from saved UI locale ## Still on the roadmap (planned) - Docs article layout: persistent sidebar TOC on desktop - Roadmap kanban: horizontal scroll affordance on mobile + column collapse memory - Public project hub: search trigger should show keyboard hint (`/`) - Guest posting: enable on demo project OR guest form with email-only - Full string i18n (next-intl extraction) — switcher is UI-only today - WCAG 2.2 AA pass (focus order, contrast audit widget) - Cookie consent: remember dismiss across sessions without re-prompt on every subdomain - Admin support desk: keyboard shortcuts (j/k navigate tickets, r reply) - Changelog: sticky tag filter bar while scrolling long feeds ## What felt great - Feedback board density and vote buttons - Roadmap kanban + prioritize flow - Login split panel design - Changelog tag filters

FeaturePlannedGeneral·1 month ago·0
HollahoopGet yours