[sh1pt-actions-fleet]

What changed

• Update the hosted OpenIcon manifest from 2026-10-10 to the 2026-10-30 catalog.
• Add all 80 service marks introduced in the latest OpenIcon set, including their base, HQ, and agentic style assets.
• Ensure PwaMart and built.indie HQ SVG URLs are served from /openicon/set/hq/svg/.

Verification

• Checked the manifest includes 452 icons and all 191 brand entries.
• Confirmed PwaMart and built.indie each resolve to an existing HQ SVG in the public set.
• git diff --check

[github-actions]

ThreatCrush Security Scan

67 finding(s)

HIGH/CRITICAL: 6 | MEDIUM: 29 | LOW: 32

Severity	Rule	Location
HIGH	secret-private-key	apps/pwa/src/routes/keyring.mjs:32
HIGH	secret-private-key	packages/cli/src/keyring.ts:83
HIGH	secret-private-key	packages/logicsrc-mcp/src/keyring.ts:20
HIGH	secret-private-key	plugins/credential-sharing/src/providers/ssh.ts:129
HIGH	js-host-header-trust	apps/commandboard-web/server.js:27
HIGH	js-ssrf-outbound-request	apps/pwa/public/sw.js:45
MEDIUM	js-unescaped-html-sink	apps/commandboard-web/src/main.ts:19
MEDIUM	sh-remote-script-execution	apps/logicsrc-web/public/install.sh:71
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/app/[[...slug]]/page.tsx:59
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/app/layout.tsx:80
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/app/pricing/page.tsx:42
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/components/breadcrumbs.tsx:43
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/components/pit-footer.tsx:16
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/components/site-shell.tsx:36
MEDIUM	js-unescaped-html-sink	apps/pwa/public/keyring.js:51
MEDIUM	sql-template-interpolation	apps/pwa/src/routes/rotation.mjs:79
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:253
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:297
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:299
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:303
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:307
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:326
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:327
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:329
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:330
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:331
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:334
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:395
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:402
MEDIUM	redos-nested-quantifier	packages/cli/src/rotation-catalog.ts:408
MEDIUM	redos-nested-quantifier	packages/opencontext/src/ids.ts:10
MEDIUM	redos-nested-quantifier	packages/opencontext/src/ids.ts:11
MEDIUM	js-timing-unsafe-mac-compare	packages/opencontext/src/validate.ts:208
MEDIUM	redos-nested-quantifier	packages/openerrand/src/browser.ts:34
MEDIUM	redos-nested-quantifier	packages/openontology/src/ids.ts:20
LOW	secret-generic-credential	apps/pwa/test/appbar.test.mjs:10
LOW	secret-private-key	apps/pwa/test/keyring.test.mjs:137
LOW	secret-generic-credential	apps/pwa/test/signup-profile.test.mjs:61
LOW	secret-generic-credential	apps/pwa/test/signup-profile.test.mjs:72
LOW	secret-openai-key	packages/cli/src/desktop-flow.test.ts:315
LOW	secret-generic-api-key	packages/cli/src/desktop-flow.test.ts:315
LOW	secret-private-key	packages/cli/src/keyring.test.ts:86
LOW	secret-private-key	packages/cli/src/keyring.test.ts:88
LOW	secret-private-key	packages/cli/src/rotate-flow.test.ts:125
LOW	secret-generic-api-key	packages/cli/src/rotate-flow.test.ts:177
LOW	secret-generic-credential	packages/cli/src/rotate-flow.test.ts:184
LOW	secret-generic-api-key	packages/cli/src/rotate-flow.test.ts:198
LOW	secret-generic-credential	packages/cli/src/rotate-flow.test.ts:204
LOW	secret-generic-credential	packages/cli/src/rotators.test.ts:52
LOW	secret-generic-credential	packages/cli/src/rotators.test.ts:75

…and 17 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.