ExoticExpansion
Video Platform
ExoticExpansion
What shipped, newest first. This list is the Project Command changelog for Exotic Expansion.
12 changes from Project Command.
Moved the attacker's 9 uploaded files into root-only evidence storage with fingerprints, switched off accounts lukeexotic1 and exopentest1105 and their 2 channels, and made their 3 videos private. Nothing was deleted.
Avatars, banners and thumbnails are redrawn on save, so anything hidden inside an image is dropped. Videos under 4 KB, or files holding script code, are refused. Download files take only a fixed list of types and are always saved as downloads, never opened in the browser. The uploads folder refuses more script and page types and hidden files. Debug and test pages are refused. The file-attachment upload works again: it loaded its config from the wrong folder.
The public talent page drops emoji from tier chips and uses ASCII dashes in booking copy, so the roster and inquiry form stay readable.
The talent directory tier filters use plain Elite, Premium, and Standard labels. Booking copy uses ASCII hyphens, and the stage stylesheet is on the server with the talent page.
The public desk drops the rainbow gradient. Headings use Fraunces, body copy uses Source Sans 3, and primary buttons are teal with white labels. Home, talent, about, and the shared header share that system.
Restores /api/chatrooms/messages/ and adds /api/chatrooms/provision/ for EE Financial budgeted social groups.
Filled create-channel so creators can add channels easily. Catalog API now serves videos, shorts, and podcasts with desktop/x/vertical formats like media.reversal.org. Session manage API lists and creates channels. Pages: https://exoticexpansion.com/dashboard/create-channel/ https://exoticexpansion.com/api/channel/catalog/?kind=shorts https://exoticexpansion.com/upload/
Creator registration requires Terms/Privacy acceptance and stores append-only acceptance rows.
Rewrote the 30-second Exotic Expansion night-cinema commercial prompt so Seedance typesets no UI. English copy (EXOTIC EXPANSION, exoticexpansion.com, scene titles) is burned in post. Domain close: exoticexpansion.com.
Channel owners can mint hashed eex_ keys that other EE apps use to list public videos and podcasts for that channel only. Uploads can be marked video or podcast. Secrets are shown once and stored as SHA-256.
Creators paste a Nexora community nxk_ token per venture on each Exotic Expansion channel. The key stays server-side and powers public news, newsletters, and blogs (Budgeted: /dashboard/settings/?channel=budgeted).
Exotic Expansion 2 now loads Backout API URL, structure, venture, org, and contract IDs from app/exoticexpansion2/.env so checkout can route through the ExoticExpansion Backout structure. Live API key stays in gitignored .env; example file uses a placeholder.