Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

The privacy and cookies pages don't mention three things the app stores

Abierto Apto para principiantes
  • ¿Algo no está bien?
#711 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
75/100
Tipo de issue
Documentación
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
typescript
Área
documentation

Línea de trabajo

Empieza por las páginas de privacidad y cookies en src/app/(legal)/ y compara su redacción actual con el comportamiento de almacenamiento descrito en el issue: commit-dialog.tsx, src/lib/rate-limit.ts, src/db/schema/rate-limits.ts y src/auth/adapter.ts. Comprueba el test de la página de cookies y cualquier artículo de ayuda sobre el autocompletado del formulario de registro. El trabajo estará terminado cuando ambas páginas informen correctamente de los tres elementos, tengan las fechas actualizadas y pasen las comprobaciones pertinentes.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug pipeline:proposed pipeline:ux

Needs your OK: this changes the wording of /privacy and /cookies. Swap pipeline:proposed for pipeline:ready to have it built.

What happens

/privacy and /cookies (src/app/(legal)/) leave out three things the code stores:

  • The sign-up form remembers the participant in the browser. commit-dialog.tsx in src/app/s/[slug]/ writes { name, email } to localStorage under opensignup:lastCommit after every successful sign-up, and reads it back to fill the next form on any signup on the instance. It has no expiry and nothing removes it. /cookies lists only cookies, and says every cookie is strictly necessary as its reason for having no banner. /privacy describes only the os_commit cookie.
  • Rate-limit rows hold email addresses. /privacy says the server records request IP addresses in short-lived rate-limit records. The per-email buckets (magicLinkPerEmail, loginCodePerEmail, commitmentPerEmail) store the normalized address as the row's subject, in plain text (src/lib/rate-limit.ts, src/db/schema/rate-limits.ts). That includes participants' addresses. Organizer ids are subjects too. Rows go within a few hours (sweepExpiredRateLimits, run hourly by housekeeping), so "short-lived" holds.
  • Google sign-in keeps the avatar address. createUser in src/auth/adapter.ts writes user.image to organizers.image. /privacy's "We store" list for organizers doesn't include it. The Google section says the provider returns an avatar, but says only the account link and tokens are stored.

Fix, in outline

  • /privacy, participants: one sentence saying the browser keeps the name and email last entered so the next form is filled in, that it never leaves the browser, and that clearing the site's data removes it.
  • /cookies: a short "Other storage in your browser" paragraph naming opensignup:lastCommit, what it holds, and that it has no expiry.
  • /privacy: say rate-limit records hold request IP addresses and the email address a sign-in link, sign-in code or sign-up is for, deleted within a few hours.
  • /privacy: add the avatar's web address to what's stored for organizers who first signed in with a third-party provider.
  • Bump "Last updated" on both pages.

Choices this makes

  • Disclose the prefill rather than remove it. Default: disclose. It's a real convenience for people who sign up often, and nothing leaves the browser. The alternatives are dropping the email from it or giving it an expiry. Those are code changes and a separate issue.
  • The "no cookie banner" reasoning. Default: say the prefill is set only after the person signs up, to fill in their own details, and stays in their browser. Don't claim it's strictly necessary. If you'd rather not have that argument on the page, the alternative is to stop storing the email.
  • The avatar. Default: disclose it. Nothing reads organizers.image, so the alternative is to stop writing it, which is a code change and also needs a check that no migration or adapter test depends on it.

Watch for

  • CLAUDE.md's "Trust docs reflect the code": use the real key name and real retention, nothing approximate.
  • src/app/(legal)/ has a cookies page test. Update it if it pins the cookie list.
  • Any help article that describes what the sign-up form remembers should say the same thing.

Done when

  • Both pages name each of the three things, with dates bumped.
  • pnpm lint && pnpm typecheck && pnpm knip && pnpm test pass.

Found by the pipeline's security scout in the legal pages against the participant dialog, rate limits and auth adapter, at bfe814c. Checked by matching each line of code against the page text that should cover it, across all of src/app/(legal)/. https://claude.ai/code/session_016YZ9SUf4VfjDXD1iaVHvCL

Lenguaje dominante
TypeScript
Estrellas
19
Forks
4
Merge medio
22 h 46 min
PR fusionados (30 d)
170

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de richshaw/OpenSignup

Todos los issues de richshaw/OpenSignup

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.