Stu Mason

Summary Compliance fixes from the audit, in rough order of legal urgency: Marketing consent is no longer pre-ticked. Pre-ticked boxes are invalid consent under UK GDPR (Planet49/ICO guidance). The registration checkbox now defaults to unchecked and the DB column default flips to ...

Profile sync (daily 02:20, after at 02:15) pushes the generated digest into the profile README between markers via the GitHub contents API. First run bootstraps the section plus Work with me / Sign up to my newsletter links pointing at stumason.dev. Existing README content is lef...

Profile sync (daily 02:20, after at 02:15) pushes the generated digest into the profile README between markers via the GitHub contents API. First run bootstraps the section plus Work with me / Sign up to my newsletter links pointing at stumason.dev. Existing README content is lef...

Summary Plugs four money-handling gaps found in the payments audit: Cancelled jobs now release the Stripe card hold. existed but was wired to nothing — cancelling a job left the client's manual-capture authorization sitting on their card until Stripe expired it (~7 days) and or...

Summary The observability + misc-security batch from the audit: Alerting (previously: nothing fired when infra died) Sentry cron monitoring on every scheduled task via — a dead scheduler or failing task raises a missed-check-in alert in Sentry. Previously a dead scheduler silen...

The hero says "I build software that uses AI to solve real problems." This makes the hero prove it: one AI-written sentence about the week's actual shipped work, directly underneath, labelled honestly as auto-generated. Anti-slop measures Input is real data: the week's merged PRs...

Summary From the funnel audit: the biggest supply-side leak. A sole-trader cleaner finishing onboarding was told "Your profile is now live" — but wasn't searchable until an admin approved their ID + Right to Work, and approve/reject sent no notification at all. Cleaners sat in ...

The hero says "I build software that uses AI to solve real problems." This makes the hero prove it: one AI-written sentence about the week's actual shipped work, directly underneath, labelled honestly as auto-generated. Anti-slop measures Input is real data: the week's merged PRs...

The claim that updates itself The strongest credential wasn't on the site: 424★ coolify-mcp, 12.3k npm installs/month, 472 stars across public repos. This adds it to the hero proof line, fetched live and cached — the numbers grow on their own. : GitHub repos (total + top repo...

The claim that updates itself The strongest credential wasn't on the site: 424★ coolify-mcp, 12.3k npm installs/month, 472 stars across public repos. This adds it to the hero proof line, fetched live and cached — the numbers grow on their own. : GitHub repos (total + top repo...

Bumps the @claude workflow from to and pins the PR-review workflow (previously action default) to the same. Requested by Stu — let's see if the reviews get sick.

Bumps the @claude workflow from to and pins the PR-review workflow (previously action default) to the same. Requested by Stu — let's see if the reviews get sick.

Summary Compliance fixes from the audit, in rough order of legal urgency: Marketing consent is no longer pre-ticked. Pre-ticked boxes are invalid consent under UK GDPR (Planet49/ICO guidance). The registration checkbox now defaults to unchecked and the DB column default flips to ...

Recreation of #86 (auto-closed when its stacked base branch was deleted). Same content, now based on main. action via existing — default, to override. Stores ; DTO prefers it. Queued at ingest (webhook + sync), no-ops without . backfill (, , ). Preserve across 30-min re-syncs (...

Recreation of #86 (auto-closed when its stacked base branch was deleted). Same content, now based on main. action via existing — default, to override. Stores ; DTO prefers it. Queued at ingest (webhook + sync), no-ops without . backfill (, , ). Preserve across 30-min re-syncs (...

Why The homepage feed was an unfiltered webhook dump: every PR appeared twice (opened + merged), dependabot bumps dominated the front page, and raw PR markdown/HTML ( blocks from dependabot bodies) leaked into the cards. For a client-facing portfolio that's noise drowning signal....

Summary Plugs four money-handling gaps found in the payments audit: Cancelled jobs now release the Stripe card hold. existed but was wired to nothing — cancelling a job left the client's manual-capture authorization sitting on their card until Stripe expired it (~7 days) and or...

Stacked on #85 — merge that first; GitHub will retarget this to main. Why Even with bot noise filtered (#85), raw PR bodies are written for reviewers, not clients. This adds the AI pass: a cheap model rewrites each PR/release into 1–2 plain-English sentences for the feed card...

Stacked on #85 — merge that first; GitHub will retarget this to main. Why Even with bot noise filtered (#85), raw PR bodies are written for reviewers, not clients. This adds the AI pass: a cheap model rewrites each PR/release into 1–2 plain-English sentences for the feed card...