Summary:\n- Appreciate the push to add Codeberg/Gitea support and tighten attestation handling.\n\nBlocking issues:\n1) Secrets leaking to the browser: reads (and .env.example now asks for it). In Vite, anything prefixed with VITE is baked into the client bundle, so setting this will expose the Codeberg OAuth client secret to every user. Client secrets must stay server-side (e.g., on the token proxy); the frontend should use PKCE/public-client only and never ship a secret. Please remove the secret from the frontend flow and keep it only on a backend/token proxy.\n2) Silent scope expansion: now defaults users with no repo globs to instead of skipping them. That silently opts every attested user into wildcard attestations across all their repos, which is a behavior/permission change from the previous explicit-opt-in globs. If this is intended, please document and gate it (or keep skip semantics) to avoid issuing attestations where users never configured repo patterns.

Summary:

• Appreciate the push to add Codeberg/Gitea support and tighten attestation handling.

Blocking issues:

1. Secrets leaking to the browser: src/main/typescript/apps/web/auth/codeberg.ts reads VITE_CODEBERG_CLIENT_SECRET (and .env.example now asks for it). In Vite, anything prefixed with VITE is baked into the client bundle, so setting this will expose the Codeberg OAuth client secret to every user. Client secrets must stay server-side (e.g., on the token proxy); the frontend should use PKCE/public-client only and never ship a secret. Please remove the secret from the frontend flow and keep it only on a backend/token proxy.
2. Silent scope expansion: AttestationService now defaults users with no repo globs to ${username}/* instead of skipping them. That silently opts every attested user into wildcard attestations across all their repos, which is a behavior/permission change from the previous explicit-opt-in globs. If this is intended, please document and gate it (or keep skip semantics) to avoid issuing attestations where users never configured repo patterns.

Blocking issues to address first:

• GitHub reports merge conflicts with dev; please rebase/resolve so the diff is reviewable.
• No CI checks are defined/running; we need a passing pipeline before merge.
• No automated tests cover the new Codeberg/Gitea adapters or platform selector flow (frontend hooks/components + backend service changes). Please add coverage, including self-hosted host scenarios and error handling.
• Generated/built assets appear in the diff; please remove build outputs and keep only source under version control.

Please resolve these and re-request review.