lukeandClaude Opus 5
25b0015f62
The worker rewrote <title> and og: tags for episode pages, but only when the User-Agent matched a hardcoded social-crawler list. Googlebot, Bingbot, GPTBot, ClaudeBot and PerplexityBot were all absent, so search and answer engines only ever saw the generic shell. Serving crawlers different HTML than users is also cloaking, which Google disallows. Episode pages are static now, so the injection is dead code. Replaces it with a 301 from /episode.html?slug=X to /episode/X/. Published YouTube descriptions and social posts still use the old form, so the redirect stays indefinitely. The slug is restricted to [a-z0-9-] before it reaches the Location header: verified that //evil.com, ../../etc/passwd, a CRLF payload and "><script> all reduce to harmless on-domain paths. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>