fix(marketing): LOW finishing pass — batch 1 (audit #17, #59, #62) - #92
Merged
Conversation
Three audit-LOW items closed; each is a tight scoped fix. #17 — Drop deprecated X-XSS-Protection header ----------------------------------------------- Modern browsers ignore `X-XSS-Protection: 1; mode=block` (Chrome dropped the auditor in M78, Firefox never honoured it). Dead weight in next.config.ts headers. Replaced with a comment that documents the why and names CSP + Trusted Types as the current XSS defense so a future reviewer doesn't put it back. #62 — Surface founding year on /about -------------------------------------- JSON-LD claimed `foundingDate: "2025"` but no visible page text matched. Hero badge expanded from "About FormaOS" to "About FormaOS · Founded 2025 · Sydney, Australia" — single visible surface, matches JSON-LD foundingDate AND `address.locality`, no new component. #59 — Blog dateModified ----------------------- Evergreen regulatory content needs "last reviewed" visibility, not just first-published date. Added optional `dateModified?: string` to the BlogPost type (defaults to publish date when not revised), threaded through to articleSchema's new `dateModified` JSON-LD field, and surfaced a visible "Updated <date>" line on /blog/[slug] only when the modified date differs from publish date. Existing posts opt in by setting `dateModified` on their data row; no current post is forced to change. Audit-doc rows #17, #59, #62 annotated with shipped status. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c08a652cec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| badge={{ | ||
| icon: <Users className="w-4 h-4 text-violet-400" />, | ||
| text: 'About FormaOS', | ||
| text: 'About FormaOS · Founded 2025 · Sydney, Australia', |
There was a problem hiding this comment.
On /about, this visible badge now says “Sydney, Australia”, but the marketing layout emits organizationSchema() for the page and lib/seo.ts still declares addressLocality: 'Adelaide' with addressRegion: 'SA'. That leaves crawlers and users seeing conflicting company location signals, and it also undercuts the audit item this change is meant to close by making the visible text not match the structured Organization address.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
This PR addresses three LOW marketing-audit items by removing a deprecated security header, aligning visible “founding year” copy with structured data, and adding support for dateModified (JSON-LD + optional visible “Updated” line) on blog posts.
Changes:
- Removed
X-XSS-Protectionfromnext.config.tsheaders and documented the rationale in-code. - Added
dateModifiedsupport to blog post data/type, threaded through to JSON-LDArticleschema, and conditionally displayed an “Updated …” line on blog posts. - Updated
/abouthero badge copy to include founding year and locality.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| next.config.ts | Drops X-XSS-Protection from static security headers and adds an explanatory comment. |
| lib/seo.ts | Extends articleSchema to include dateModified with a default to datePublished. |
| docs/audit/2026-05-13-marketing-audit.md | Marks audit rows as shipped for the addressed LOW items. |
| app/(marketing)/blog/blogData.ts | Adds optional dateModified to the BlogPost type. |
| app/(marketing)/blog/[slug]/page.tsx | Emits dateModified in JSON-LD and conditionally renders a visible “Updated” line. |
| app/(marketing)/about/AboutPageContent.tsx | Updates hero badge text to include founding year and location. |
Comments suppressed due to low confidence (2)
app/(marketing)/about/AboutPageContent.tsx:70
- The hero badge now says “Founded 2025”, but the same page’s “Company Timeline” includes milestones in 2022–2024 and specifically states “FormaOS deployed with its first NDIS provider” in 2023. Please reconcile these so the visible founding-year claim doesn’t contradict the timeline (either adjust the badge year, or reword the pre-2025 milestones as pre-founding work).
visualInteractive
badge={{
icon: <Users className="w-4 h-4 text-violet-400" />,
text: 'About FormaOS · Founded 2025 · Sydney, Australia',
colorClass: 'violet',
}}
headline={
<>
Compliance infrastructure
docs/audit/2026-05-13-marketing-audit.md:129
- This audit doc marks multiple rows as “Shipped in #TBD”. Before merge, replace
#TBDwith the actual PR number(s) so the audit trail stays accurate and clickable.
| 12 | MED | Many pages | Top-level page titles run **>60 characters** on at least 22 pages, including `/`, `/pricing`, `/ndis-providers`, `/healthcare-compliance`, `/healthcare-compliance-platform`, `/childcare-compliance`, `/construction-compliance`, `/audit-evidence-management`, all four `/compare/*`. Google truncates around 60. Most of these include "\| FormaOS" + a tagline that's already in the meta description. | Tighten title to `<Action verb> — <vertical> \| FormaOS` shape; move the long-tail to the description. |
| 13 | MED | Many pages | Meta description >170 characters on ~16 pages (`/`, `/pricing`, `/features`, `/compare`, `/enterprise`, `/childcare-compliance`, `/construction-compliance`, `/financial-services-compliance`, `/healthcare-compliance-platform`, `/ndis-compliance-system`, `/ndis-providers`, `/integrations`, `/roadmap`, `/what-is-a-compliance-operating-system`, plus two blog posts). Google truncates around 155–160. | Trim to ≤160 chars. |
| 14 | MED | Many pages | Meta description **<100 characters** on `/status` (44), `/terms` (39), `/trust/data-handling` (74), `/trust/subprocessors` (71), `/trust/sla` (89), `/trust/dpa` (95), `/trust/incident-response` (84), `/trust/procurement` (82), `/evaluate` (84), `/legal` (99), `/our-story` (93), `/prove` (97). Short descriptions waste SERP real estate. | Expand to ~140–155 chars; trust pages especially deserve a real summary. |
| 15 | MED | Whole site | The CSP allows `'unsafe-inline'` for `script-src` and `style-src`. The `2026-05-12-deep-audit.md` already flagged this (finding #11) — listing here so the marketing-side awareness is on record. No new code change implied. | Defer to existing finding. |
| 16 | MED | Home + JSON-LD on every page | Organization JSON-LD `sameAs` lists `https://twitter.com/EjazDev` — that's the founder's personal handle, not a company handle. Treated by knowledge-graph indexers as the company's social profile. **Shipped in #78** — dropped the personal handle; LinkedIn company page is the only `sameAs` until a company X handle exists. | Replace with a company handle, or drop the `sameAs` Twitter entry until one exists. |
| 17 | LOW | All pages | `x-xss-protection: 1; mode=block` is sent in headers. The header is deprecated; modern browsers ignore it. Not harmful, just dead weight. **Shipped in #TBD (LOW batch 1)** — dropped from `next.config.ts`. Replaced with a comment that documents the why and points at CSP + Trusted Types as the current XSS defense. | Drop from `next.config.ts` headers config. |
| 18 | LOW | Home `<head>` | HTML response is **202 KB** uncompressed (`/`), `112 KB` (`/pricing`), `86 KB` (`/features`). The home weight in particular is dominated by the streaming RSC payload. Likely fine after gzip/brotli but worth a Lighthouse pass before any LCP improvement work. | (verify) Lighthouse pass before assuming this matters. |
| 19 | LOW | Site-wide footer mailto | Two raw HTML files (`trust/subprocessors.html`, `trust/dpa.html`) contain a JSON-escaped `mailto:Formaos.team@gmail.com\"` in the streaming payload, which looks like a backslash leak. Verified — it's just JSON escaping, not user-visible. No action needed; noting so the next grep doesn't trip on it. | — |
## §4 — Per-page findings
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
176
to
190
| async headers() { | ||
| return [ | ||
| { | ||
| // Security headers for all routes (marketing + app) | ||
| source: '/:path*', | ||
| headers: [ | ||
| { key: 'X-Frame-Options', value: 'DENY' }, | ||
| { key: 'X-Content-Type-Options', value: 'nosniff' }, | ||
| { key: 'X-XSS-Protection', value: '1; mode=block' }, | ||
| // X-XSS-Protection removed 2026-05-14 (audit row #17). The | ||
| // header is deprecated; modern browsers ignore it. Chrome | ||
| // dropped the auditor in M78, Firefox never honoured it, | ||
| // Safari kept the attribute but tied it to "block" only, | ||
| // which CSP already covers. CSP + Trusted Types are the | ||
| // current defence. | ||
| { key: 'X-DNS-Prefetch-Control', value: 'on' }, |
Comment on lines
+188
to
+189
| // which CSP already covers. CSP + Trusted Types are the | ||
| // current defence. |
Comment on lines
74
to
82
| articleSchema({ | ||
| title: post.title, | ||
| description: post.excerpt, | ||
| url: `${siteUrl}/blog/${post.id}`, | ||
| datePublished: new Date(post.date).toISOString(), | ||
| dateModified: post.dateModified | ||
| ? new Date(post.dateModified).toISOString() | ||
| : new Date(post.date).toISOString(), | ||
| author: post.author, |
♿ Accessibility Test Results✅ PASSED - No critical accessibility issues found Tests Performed:
Artifacts: Download the accessibility reports from the "Artifacts" section for detailed results. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three audit-LOW items, scoped tight. Each is a small mechanical or near-mechanical change.
#17 — Drop deprecated
X-XSS-ProtectionheaderModern browsers ignore it (Chrome dropped the auditor in M78, Firefox never honoured it). Removed from
next.config.tsand replaced with a comment naming CSP + Trusted Types as the current XSS defense so a future reviewer doesn't put it back.#62 — Surface founding year on
/aboutJSON-LD claimed
foundingDate: "2025"but no visible page text matched. Hero badge expanded from "About FormaOS" to "About FormaOS · Founded 2025 · Sydney, Australia" — single visible surface, matches both JSON-LDfoundingDateandaddress.locality.#59 — Blog
dateModifiedEvergreen regulatory content readers need "last reviewed" visibility. Added optional
dateModified?: stringtoBlogPost(defaults to publish date when not revised), threaded through to a newdateModifiedfield onarticleSchema, and surfaced a visible "Updated " line on/blog/[slug]only when modified differs from publish. Existing posts opt in by settingdateModifiedon their data row — no current post is forced to change.Audit doc rows annotated with shipped status.
Test plan
curl <preview>/ | grep -i 'x-xss'returns nothing/about: hero badge reads "About FormaOS · Founded 2025 · Sydney, Australia"dateModifiedon its data row; JSON-LDdateModifiedalways present