Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

The privacy and cookies pages don't mention three things the app stores

オープン 初心者向け
  • 何か問題がありますか？
#711 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
75/100
issue の種類
ドキュメント
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
typescript
領域
documentation

調査の方向性

src/app/(legal)/ にあるプライバシーと Cookie のページから始め、現在の文言を、issue に記載されたデータ保存の挙動と比較してください: commit-dialog.tsx、src/lib/rate-limit.ts、src/db/schema/rate-limits.ts、src/auth/adapter.ts。Cookie ページのテストと、登録フォームの事前入力に関するヘルプ記事があれば確認してください。両方のページで3項目すべてが正確に開示され、日付が更新され、関連するチェックが通れば完了です。

索引モデルが issue の本文から書いたものです。

説明

bug pipeline:proposed pipeline:ux

Needs your OK: this changes the wording of /privacy and /cookies. Swap pipeline:proposed for pipeline:ready to have it built.

What happens

/privacy and /cookies (src/app/(legal)/) leave out three things the code stores:

  • The sign-up form remembers the participant in the browser. commit-dialog.tsx in src/app/s/[slug]/ writes { name, email } to localStorage under opensignup:lastCommit after every successful sign-up, and reads it back to fill the next form on any signup on the instance. It has no expiry and nothing removes it. /cookies lists only cookies, and says every cookie is strictly necessary as its reason for having no banner. /privacy describes only the os_commit cookie.
  • Rate-limit rows hold email addresses. /privacy says the server records request IP addresses in short-lived rate-limit records. The per-email buckets (magicLinkPerEmail, loginCodePerEmail, commitmentPerEmail) store the normalized address as the row's subject, in plain text (src/lib/rate-limit.ts, src/db/schema/rate-limits.ts). That includes participants' addresses. Organizer ids are subjects too. Rows go within a few hours (sweepExpiredRateLimits, run hourly by housekeeping), so "short-lived" holds.
  • Google sign-in keeps the avatar address. createUser in src/auth/adapter.ts writes user.image to organizers.image. /privacy's "We store" list for organizers doesn't include it. The Google section says the provider returns an avatar, but says only the account link and tokens are stored.

Fix, in outline

  • /privacy, participants: one sentence saying the browser keeps the name and email last entered so the next form is filled in, that it never leaves the browser, and that clearing the site's data removes it.
  • /cookies: a short "Other storage in your browser" paragraph naming opensignup:lastCommit, what it holds, and that it has no expiry.
  • /privacy: say rate-limit records hold request IP addresses and the email address a sign-in link, sign-in code or sign-up is for, deleted within a few hours.
  • /privacy: add the avatar's web address to what's stored for organizers who first signed in with a third-party provider.
  • Bump "Last updated" on both pages.

Choices this makes

  • Disclose the prefill rather than remove it. Default: disclose. It's a real convenience for people who sign up often, and nothing leaves the browser. The alternatives are dropping the email from it or giving it an expiry. Those are code changes and a separate issue.
  • The "no cookie banner" reasoning. Default: say the prefill is set only after the person signs up, to fill in their own details, and stays in their browser. Don't claim it's strictly necessary. If you'd rather not have that argument on the page, the alternative is to stop storing the email.
  • The avatar. Default: disclose it. Nothing reads organizers.image, so the alternative is to stop writing it, which is a code change and also needs a check that no migration or adapter test depends on it.

Watch for

  • CLAUDE.md's "Trust docs reflect the code": use the real key name and real retention, nothing approximate.
  • src/app/(legal)/ has a cookies page test. Update it if it pins the cookie list.
  • Any help article that describes what the sign-up form remembers should say the same thing.

Done when

  • Both pages name each of the three things, with dates bumped.
  • pnpm lint && pnpm typecheck && pnpm knip && pnpm test pass.

Found by the pipeline's security scout in the legal pages against the participant dialog, rate limits and auth adapter, at bfe814c. Checked by matching each line of code against the page text that should cover it, across all of src/app/(legal)/. https://claude.ai/code/session_016YZ9SUf4VfjDXD1iaVHvCL

主要言語
TypeScript
スター
19
フォーク
4
平均マージ
22時間 46分
マージ済み PR（30日）
170

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

richshaw/OpenSignup のほかの issue

richshaw/OpenSignup の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。