2 Commits

Author SHA1 Message Date
Émile Ré
f0fe70fe1c Restore url.PathEscape on user-supplied path segments in url.JoinPath calls
url.JoinPath does not percent-encode slashes or reserved characters in
its arguments, so user-supplied values (group IDs, slugs, team IDs) must
be wrapped with url.PathEscape to prevent path traversal. Update cursor
rule and contrib guide to codify this as a mandatory practice.

Signed-off-by: Émile Ré <emile@probo.com>
2026-05-20 12:57:26 +04:00
Émile Ré
8f8f09008a Version Cursor rules
Track .cursor/rules/ in git so coding conventions are shared
across the team. Everything else under .cursor/ stays ignored.

Signed-off-by: Émile Ré <emile@probo.com>
2026-05-19 14:10:39 +04:00