Deploy Notes 09.29.2026

Random Thoughts from a Restless Mind

Category: Deploy Notes

Published On: September 29, 2026

💧 The Droplets

[Routine maintenance — packages updated, reboots applied. No infrastructure changes this week.]

🏠 Personal Home Page — v2026.9.4

This is the biggest release this site has seen in a while. The headline is a new Games section: ad-free browser games, no login, nothing tracked beyond the site-wide analytics. Three games out of the gate:

• Sea Battle — two players, either pass-and-play on one screen (with a blank hand-off screen between turns so nobody peeks at your fleet) or online, where one person creates a game and the other joins by short code or link.
• Four in a Row — same two modes, but since there's nothing to hide, the board stays up and just follows whose turn it is. "Play again" swaps who goes first, because moving first in this game is a real advantage.
• Solitaire — Klondike, the first one-player game. Draw 1 or Draw 3, undo, tap-to-move with legal targets highlighted, and an auto-finish button once every card is face up. The deck lives on the server, so no peeking with dev tools either.

Games are ephemeral — anything idle for 48 hours gets purged by the site's first-ever cron job. There's also a new Contact page, with messages landing in the admin (email notification is wired but stays off until production has a real mailer). Behind that, a full security pass: Turbo 8 and Symfony 7.4.19, logout as a CSRF-checked POST, a hardened password-change form, a dedicated security audit log, a CSP baseline, /security plus security.txt, and sessions moving out of the shared PHP session directory into the app's own — which signed everyone out once. All one of me.

🎬 They Said It! — v2026.9.4 — theysaidit.app

Mostly under the hood this week: dependencies brought current (Symfony 7.4.11 → 7.4.19, Turbo 7.3 → 8, which closed a session-cookie advisory), then the same security audit the home page went through. The one real find: EasyAdmin prints flash messages as raw HTML, and one of the admin's flashes quotes a visitor's search query — so a crafted search could have run script in the admin. That's closed. The search and movie-view beacons and the contact form are now rate-limited per IP, logout is a POST, login events go to a security.log, and two small fixes: an oversized contact message is now a validation error instead of a 500, and typing a backslash into the search suggestions actually matches a backslash.

🔮 On Deck

More games — Ludo is next on the list as the first real test of more than two seats, and Sudoku is the natural next solo game. Contact-form email notifications once the mailer is set up.