[GoDeskio]

Summary

The marketing site in apps/web-marketing is now the real Komboe site, still not deployed.

• The home page Hero has a sign-in form. It uses the web vault flow: prelogin, a local master-password hash, /identity/connect/token, and a two-step code when the account has one. Success opens /vault, which loads that account from the server. A wrong password shows “Email or master password is incorrect.” A signed-in visitor sees Open dashboard instead of the form. Create account still goes to signup.html.
• Every page uses the Komboe glass layout, soft button shadows, a sticky nav, and the assistant. Feature cards link to other products that offer the same idea. The assistant calls the existing Komboe agent (/api/komboe/agent/session and /act) after sign-in. It can explain a feature, suggest next steps, or generate a password, and it does not read vault items.
• Pages ship with a strict content security policy (no inline scripts, no stored secrets). Sign-in sends one attempt at a time and does not retry a 429.

Proof

bash apps/web-marketing/e2e/run.sh starts the server, creates an account, turns on authenticator two-step login, signs in from the home page, and checks the dashboard. CI runs that in the marketing job.

  

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​playwright/​test@​1.49.1

View full report