[sh1pt-actions-fleet]

Summary

• Allow the same CoinPay identity to connect to multiple signed-in SMSHub accounts, while retaining one connection per local account.
• Use the shared CoinPay identity resolver and consistently sign in to the oldest linked account.
• Add the Supabase index migration and update @profullstack/coinpay-onboard to 0.4.0.

Verification

• bun run test (369 passed)
• bun run typecheck
• bun run lint (warnings only)

[github-actions]

ThreatCrush Security Scan

14 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 4 | LOW: 8

Severity	Rule	Location
HIGH	sh-unquoted-expansion-destructive	public/install.sh:67
HIGH	sh-remote-script-execution	public/install.sh:89
MEDIUM	sh-remote-script-execution	public/install.sh:133
MEDIUM	js-open-redirect	src/app/numbers/page.tsx:180
MEDIUM	js-open-redirect	src/components/inbox-client.tsx:35
MEDIUM	js-unescaped-html-sink	src/components/pit-footer.tsx:17
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:24
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:46
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:60
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:78
LOW	secret-generic-credential	src/lib/vault/__tests__/vault.test.ts:117
LOW	secret-generic-credential	src/lib/webhooks/__tests__/supabase-store.test.ts:11
LOW	secret-generic-credential	supabase/config.toml:287
LOW	secret-generic-credential	supabase/config.toml:319

Snippets are redacted; ThreatCrush never prints matched credential material.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​coinpay-onboard@​0.3.1 ⏵ 0.4.0	-2		+1	+1

View full report