Huddle hardening: lessons from ProjectHuddle/SureFeedback history

Imported from GitHub issue El-SaMa/hollahoop#130 by @El-SaMa.

---

From their changelog (3.2.2 → 4.9.2), both wp.org client plugins, forum and docs, checked against our code.

Risks (fix first)

1. Selector drift: pickSelector not unique, textless elements match first element (pin-chunk.ts:391-397, :260,:270) → uniqueness check, nth-of-type path, attribute + size hints, XPath fallback
2. Client feedback public: Huddle requires public project and every pin becomes a public board post; pins/thread GET open with site id; no-Origin passes (huddle-public.ts:40, linked-feedback-post.ts:79-90, embed-origin.ts:9) → private Huddle board + review-only mode requiring guest/staff/user token
3. Pins vanish on URL variants (utm, fbclid, trailing slash, www) (page-url.ts:9-12) → normalized page key + per-site meaningful params
4. SPA/pjax navigation: no pushState/popstate hook, root removed by Turbo/Swup (pin-chunk.ts:235,368-374) → history hooks + root re-attach
5. Loads inside page builders/customizer (access.php:357-369) → skip elementor-preview, et_fb, fl_builder, bricks, ct_builder, is_customize_preview + filter
6. Comment mode still triggers sliders/menus (only click cancelled, pin-chunk.ts:530-535) → cancel pointer/mouse/touch down/up or catcher layer
7. Page caches serve script-less page to review guests (front.php:44-49) → DONOTCACHEPAGE, LiteSpeed nocache, WP Rocket reject cookies / vary, or client-side gating
8. Staff/guest tokens in query string leak to logs/analytics/Referer (pin-chunk.ts:44-54) → #fragment or one-time code
9. Screenshots: 5000-node cap, full clone, no bg images/fonts, likely Safari taint (shot-chunk.ts) → viewport-only walk, inline same-origin assets, Safari test
10. Screenshots capture typed form values, stored public forever (shot-chunk.ts:79, huddle-thread.ts:49-50) → blank inputs, data-huddle-mask, signed URLs
11. Sticky/fixed elements and scroll containers drift (pin-chunk.ts:285-337) → anchor to element, scroll/ResizeObserver re-render
12. Origin lock exact host (www vs apex, staging) 404 silently (embed-origin.ts:26-31) → www equivalence, extra origins, dashboard warning
13. Loader script detection after optimizers; bubble mode crashes in <head> (loader-script.ts:14-24,:136)
14. Every load fetches all site pins (huddle-thread.ts:79-85) → SQL filter by normalized page key
15. Small: board choice inconsistent, raw DB error to visitor, WP accepts http base URL, Safari wipes localStorage ownership

Missing features

Page/site approvals; auto-identify logged-in WP users (data-user); ignore-query matching; SPA support; private comments/token-gated reads; request changes + assignee reminders from overlay; overlay attachments; minimize + remembered position; per-page off for non-WP; client digests; realtime updates.

Sources: surefeedback.com/whats-new (pages 1-18), surefeedback.com/changelog, wordpress.org/plugins/projecthuddle-child-site, its support forum, surefeedback docs (exclude-caching, widget-not-showing, ssl-and-https, hosting), Patchstack, CVE-2023-51376.