[sh1pt-actions-fleet]

Summary

• Permit the same verified CoinPay identity to connect to multiple signed-in sh1pt accounts, while retaining one identity per local account.
• Use the shared CoinPay identity resolver and consistently sign in to the oldest linked account.
• Add the Supabase migration and update @profullstack/coinpay-onboard to 0.4.0.

Verification

• Focused CoinPay test: 10 passed.
• Workspace package builds passed.
• Full local pnpm test could not resolve workspace packages because only filtered workspace dependencies are installed; GitHub CI will run against the full workspace install.

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.

[github-actions]

ThreatCrush Security Scan

55 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 18 | LOW: 35

Severity	Rule	Location
HIGH	js-host-header-trust	packages/bots/wechat/src/index.ts:405
HIGH	js-ssrf-outbound-request	sites/sh1pt.com/public/sw.js:21
MEDIUM	redos-nested-quantifier	packages/actions-fleet-core/src/action-pack/schema.ts:3
MEDIUM	redos-nested-quantifier	packages/core/src/setup-helpers.ts:583
MEDIUM	sql-template-interpolation	packages/migrate/src/engines/mysql.ts:133
MEDIUM	sql-template-interpolation	packages/migrate/src/engines/postgres.ts:276
MEDIUM	sql-template-interpolation	packages/migrate/src/transforms.ts:178
MEDIUM	redos-nested-quantifier	packages/policy/src/rules/bundle-id.ts:3
MEDIUM	sql-string-concatenation	packages/targets/deploy-wordpress/src/index.ts:154
MEDIUM	redos-nested-quantifier	packages/targets/desktop-linux/src/index.ts:19
MEDIUM	redos-nested-quantifier	packages/targets/desktop-mac/src/index.ts:15
MEDIUM	redos-nested-quantifier	packages/targets/desktop-steamos/src/index.ts:28
MEDIUM	redos-nested-quantifier	packages/targets/mobile-android/src/index.ts:9
MEDIUM	redos-nested-quantifier	packages/targets/mobile-ios/src/index.ts:11
MEDIUM	redos-nested-quantifier	packages/targets/tv-androidtv/src/index.ts:14
MEDIUM	redos-nested-quantifier	packages/targets/tv-firetv/src/index.ts:13
MEDIUM	redos-nested-quantifier	packages/targets/tv-tvos/src/index.ts:14
MEDIUM	redos-nested-quantifier	packages/targets/tv-webos/src/index.ts:26
MEDIUM	js-unescaped-html-sink	sites/sh1pt.com/app/blog/[slug]/page.tsx:88
MEDIUM	js-unescaped-html-sink	sites/sh1pt.com/app/components/PitFooter.tsx:17
LOW	secret-generic-credential	packages/affiliates/skimlinks/src/index.test.ts:25
LOW	secret-generic-credential	packages/affiliates/skimlinks/src/index.test.ts:71
LOW	secret-generic-api-key	packages/affiliates/sovrn/src/index.ts:28
LOW	secret-generic-credential	packages/agent-providers/opencode/src/__tests__/opencode.test.ts:99
LOW	js-nosql-injection	packages/ai/amazon-bedrock/src/index.test.ts:121
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:9
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:10
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:11
LOW	secret-generic-credential	packages/bridges/matrix/src/index.ts:58
LOW	secret-generic-credential	packages/bridges/matrix/src/index.ts:59
LOW	secret-generic-credential	packages/bridges/slack/src/index.test.ts:259
LOW	secret-generic-credential	packages/captcha/captchasolver/src/index.ts:34
LOW	secret-generic-credential	packages/cli/src/commands/secrets.ts:189
LOW	secret-generic-credential	packages/cloud/linode/src/index.ts:15
LOW	secret-generic-credential	packages/migrate/src/platforms/index.test.ts:116
LOW	secret-generic-credential	packages/observability/sentry/src/index.ts:15
LOW	secret-generic-credential	packages/outreach/producthunt/src/index.ts:103
LOW	secret-generic-credential	packages/promo/posthog/src/index.ts:23
LOW	secret-generic-credential	packages/scanners/threatcrush/test/scan-output.txt:35
LOW	secret-generic-credential	packages/scanners/threatcrush/test/scan-output.txt:40
LOW	secret-database-url	packages/scanners/threatcrush/test/scan-output.txt:54
LOW	secret-generic-credential	packages/security/snyk/src/index.ts:26
LOW	secret-generic-credential	packages/social/hashnode/src/index.ts:4
LOW	secret-generic-credential	packages/social/linkedin/src/index.ts:3
LOW	secret-generic-credential	packages/social/linkedin/src/index.ts:4
LOW	secret-generic-credential	packages/social/medium/src/index.ts:4
LOW	secret-generic-credential	packages/social/snapchat/src/index.ts:5
LOW	secret-generic-credential	packages/social/tiktok/src/index.ts:5
LOW	secret-generic-credential	packages/targets/plugin-vscode/src/index.test.ts:115
LOW	secret-generic-credential	packages/targets/registry-ans/src/index.test.ts:79

…and 5 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​profullstack/​coinpay-onboard@​0.3.1 ⏵ 0.4.0	-2		+1	+1
	npm/​@​profullstack/​footer@​0.5.0 ⏵ 0.6.5	+5		+1	+1

View full report