[harlan-zw]

❓ Type of change

• 🐞 Bug fix
• 🧹 Chore

📚 Description

Privacy audit follow-ups. Each one kept or leaked personal data for no product reason.

• Sign-out left GitHub tokens behind. Logout only cleared the cookie, so the encrypted GitHub access and refresh tokens stayed in users. Sign-out now deletes them. Star import and repository scan in another open session return a 401 that says to sign in with GitHub again. The next GitHub sign-in stores new tokens, so nothing is lost.
• Nothing was ever purged. A daily purge-personal-data task (shares the 04:30 trigger, so no new Cloudflare cron) deletes:
  • CLI tokens revoked or expired more than 7 days ago.
  • CLI auth codes and device sessions older than 1 day. Both expire after 10 minutes.
  • weekly_runs and email_preference_events older than 90 days. Opt-in state lives on users, so no reader needs old events. The admin weekly view reads only the last 8 weeks.
  • digest_runs older than 90 days, except each account's newest sent or skipped run, because that row holds the next digest cursor. Unresolved runs (failed, uncertain, claimed, sending) also stay, since deleting them could cause a duplicate send.
• SKILL.md images could be tracking pixels. Images now load only over https from GitHub content hosts (raw.githubusercontent.com, user-images, private-user-images, avatars, github.com/<owner>/<repo>/raw/..., github.com/user-attachments/assets/...), with referrerpolicy="no-referrer" and loading="lazy". Any other image becomes a link, or plain alt text when it already sits in a link.

machine_hint stays: the authorize page shows it so a person can confirm which machine signs in.

Open questions:

• shields.io style badges now show as text. That seemed the right call for a privacy default, but proxying them is an option if it looks bad.
• I added user-attachments/assets beyond the audit list, since new GitHub uploads live there.
• The 7 day grace window for ended CLI tokens is a guess. After it, a revoked token no longer shows on /me/devices.

📝 Migration

• No D1 migration.
• purge-personal-data sets activeFromSeconds to 17 Sep 2026 00:00 UTC. If this deploys after about 18 Sep 12:00 UTC, the daily health check can report one missing run until the first 04:30 run.
• The first purge run deletes the whole backlog in one batch.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-09-21 06:54 UTC.

GitHub merged this pull request.

No material findings were recorded.

32387c99-eb1f-44bc-bb93-b76713b75975