Skip to content

feat(pass): Profullstack Pass grants sh1pt Pro until it ends - #1057

Merged
ralyodio merged 1 commit into
masterfrom
feat/coinpay-pass
Nov 7, 2026
Merged

ralyodio merged 1 commit into
masterfrom
feat/coinpay-pass

Conversation

@ralyodio

@ralyodio ralyodio commented Nov 7, 2026

Copy link
Copy Markdown
Contributor

Profullstack Pass: a CoinPay user who deposited $99 into their own CoinPay wallet gets a free month of sh1pt Pro.

  • CoinPay callback reads pass via @profullstack/coinpay-onboard ^0.5.0 and stores profiles.coinpay_pass_until for the account bound to the CoinPay sub (never by email).
  • planStatus = Pro while prepaid or greatest(pro_until, coinpay_pass_until) > now; the pass never consumes paid/granted days.
  • Migration sites/sh1pt.com/supabase/migrations/20261107120000_coinpay_pass.sql (add column).
  • Unit test sites/sh1pt.com/lib/coinpay-pass.test.ts.

No pricing page exists on sh1pt.com, so no copy change.

🤖 Generated with Claude Code

CoinPay sign-in reads the userinfo `pass` claim (coinpay-onboard ^0.5.0)
and stores its end on profiles.coinpay_pass_until for the account bound
to the CoinPay sub. planStatus counts Pro until the later of pro_until
and the pass, without consuming paid or granted days.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 7, 2026

Copy link
Copy Markdown

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.

@github-actions

github-actions Bot commented Nov 7, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

55 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 18 | LOW: 35

Severity Rule Location
HIGH js-host-header-trust packages/bots/wechat/src/index.ts:405
HIGH js-ssrf-outbound-request sites/sh1pt.com/public/sw.js:21
MEDIUM redos-nested-quantifier packages/actions-fleet-core/src/action-pack/schema.ts:3
MEDIUM redos-nested-quantifier packages/core/src/setup-helpers.ts:583
MEDIUM sql-template-interpolation packages/migrate/src/engines/mysql.ts:133
MEDIUM sql-template-interpolation packages/migrate/src/engines/postgres.ts:276
MEDIUM sql-template-interpolation packages/migrate/src/transforms.ts:178
MEDIUM redos-nested-quantifier packages/policy/src/rules/bundle-id.ts:3
MEDIUM sql-string-concatenation packages/targets/deploy-wordpress/src/index.ts:154
MEDIUM redos-nested-quantifier packages/targets/desktop-linux/src/index.ts:19
MEDIUM redos-nested-quantifier packages/targets/desktop-mac/src/index.ts:15
MEDIUM redos-nested-quantifier packages/targets/desktop-steamos/src/index.ts:28
MEDIUM redos-nested-quantifier packages/targets/mobile-android/src/index.ts:9
MEDIUM redos-nested-quantifier packages/targets/mobile-ios/src/index.ts:11
MEDIUM redos-nested-quantifier packages/targets/tv-androidtv/src/index.ts:14
MEDIUM redos-nested-quantifier packages/targets/tv-firetv/src/index.ts:13
MEDIUM redos-nested-quantifier packages/targets/tv-tvos/src/index.ts:14
MEDIUM redos-nested-quantifier packages/targets/tv-webos/src/index.ts:26
MEDIUM js-unescaped-html-sink sites/sh1pt.com/app/blog/[slug]/page.tsx:88
MEDIUM js-unescaped-html-sink sites/sh1pt.com/app/components/PitFooter.tsx:17
LOW secret-generic-credential packages/affiliates/skimlinks/src/index.test.ts:25
LOW secret-generic-credential packages/affiliates/skimlinks/src/index.test.ts:71
LOW secret-generic-api-key packages/affiliates/sovrn/src/index.ts:28
LOW secret-generic-credential packages/agent-providers/opencode/src/__tests__/opencode.test.ts:99
LOW js-nosql-injection packages/ai/amazon-bedrock/src/index.test.ts:121
LOW secret-generic-credential packages/ai/amazon-bedrock/src/index.ts:9
LOW secret-generic-credential packages/ai/amazon-bedrock/src/index.ts:10
LOW secret-generic-credential packages/ai/amazon-bedrock/src/index.ts:11
LOW secret-generic-credential packages/bridges/matrix/src/index.ts:58
LOW secret-generic-credential packages/bridges/matrix/src/index.ts:59
LOW secret-generic-credential packages/bridges/slack/src/index.test.ts:259
LOW secret-generic-credential packages/captcha/captchasolver/src/index.ts:34
LOW secret-generic-credential packages/cli/src/commands/secrets.ts:189
LOW secret-generic-credential packages/cloud/linode/src/index.ts:15
LOW secret-generic-credential packages/migrate/src/platforms/index.test.ts:116
LOW secret-generic-credential packages/observability/sentry/src/index.ts:15
LOW secret-generic-credential packages/outreach/producthunt/src/index.ts:103
LOW secret-generic-credential packages/promo/posthog/src/index.ts:23
LOW secret-generic-credential packages/scanners/threatcrush/test/scan-output.txt:35
LOW secret-generic-credential packages/scanners/threatcrush/test/scan-output.txt:40
LOW secret-database-url packages/scanners/threatcrush/test/scan-output.txt:54
LOW secret-generic-credential packages/security/snyk/src/index.ts:26
LOW secret-generic-credential packages/social/hashnode/src/index.ts:4
LOW secret-generic-credential packages/social/linkedin/src/index.ts:3
LOW secret-generic-credential packages/social/linkedin/src/index.ts:4
LOW secret-generic-credential packages/social/medium/src/index.ts:4
LOW secret-generic-credential packages/social/snapchat/src/index.ts:5
LOW secret-generic-credential packages/social/tiktok/src/index.ts:5
LOW secret-generic-credential packages/targets/plugin-vscode/src/index.test.ts:115
LOW secret-generic-credential packages/targets/registry-ans/src/index.test.ts:79

…and 5 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​profullstack/​coinpay-onboard@​0.4.0 ⏵ 0.5.080 +7100100 +194 +1100

View full report

@ralyodio
ralyodio merged commit 66988d0 into master Nov 7, 2026
8 checks passed
@ralyodio
ralyodio deleted the feat/coinpay-pass branch November 7, 2026 16:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant