feat: add custom branding

[Kanashimo]

Allows you to change display name of the website, so you can put your domain or something else there

---

Summary by cubic

Make the header site name configurable. Previously the header always showed "ConvertX"; now it reads BRANDING (defaults to "ConvertX") and truncates names longer than 26 characters.

• Adds BRANDING env var and documents it in README.
• Adds optional branding prop to Header; all main pages pass BRANDING.
• No migration required; default preserves existing behavior.

^{Written for commit 0fd12b9. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 8 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/pages/user.tsx">

<violation number="1" location="src/pages/user.tsx:140">
P2: A `BRANDING` value containing HTML can execute script in every rendered auth page because this new wiring feeds the environment value into `Header`, whose branding child is unescaped. Escaping the branding text in `Header` (for example with a `safe` innermost element) would prevent a deployment/configuration value from becoming XSS.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: A BRANDING value containing HTML can execute script in every rendered auth page because this new wiring feeds the environment value into Header, whose branding child is unescaped. Escaping the branding text in Header (for example with a safe innermost element) would prevent a deployment/configuration value from becoming XSS.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pages/user.tsx, line 140:

<comment>A `BRANDING` value containing HTML can execute script in every rendered auth page because this new wiring feeds the environment value into `Header`, whose branding child is unescaped. Escaping the branding text in `Header` (for example with a `safe` innermost element) would prevent a deployment/configuration value from becoming XSS.</comment>

<file context>
@@ -136,6 +137,7 @@ export const user = new Elysia()
         <>
           <Header
             webroot={WEBROOT}
+            branding={BRANDING}
             accountRegistration={ACCOUNT_REGISTRATION}
             allowUnauthenticated={ALLOW_UNAUTHENTICATED}
</file context>

[C4illin]

Just do a <a href={${webroot}/} safe> to fix it

[C4illin]

the linter should complain

[C4illin]

Looks good! Just fix the lint errors

[Kanashimo]

Fixed