Extension:
- SQL injection fix: dollar-quoting instead of single-quote escaping
- Cache team.json + resolved member (no re-reads every call)
- System prompt: removed forceful 'Always use member=X', now says auto-detected
- Member name sanitisation: strip non-alphanumeric chars
API (server.js):
- Auth middleware: requireAuth on POST/PATCH/DELETE endpoints (SHIPS_API_KEY env)
- Member normalisation: cleanMember() strips special chars, lowercases
- Case-insensitive queries: LOWER() on all member WHERE/GROUP BY clauses
- XSS prevention: member values sanitised on insert
Frontend (index.html):
- renderFilters: clear old pills before appending (fixes duplication bug)
- filterByMember: hero count stays fixed to total (not filtered count)
- filterByMember: fetches global stats separately for hero + team bar
- filterByMember: loading state (opacity transition during fetch)
- filterByMember: resets project filter when switching members
- renderTeamBar: hidden when ≤1 member (removes redundant UI)
- renderTeamBar: properly manages Everyone pill active state
- renderTeamBar: esc() on member names to prevent XSS
omair
53d8324fb4