clapointe-carbonleo/mike-legal
A CarbonLeo-built Mike variant, reshaped as CarbonIQ and moving toward a Vercel-hosted internal product.
clapointe-carbonleo is building CarbonIQ: a rebranded Mike experience hosted on Vercel rather than its earlier platform. It appears aimed at getting a tailored, in-house version into use quickly.
Access has evolved from a simple internal-user setup into login backed by Supabase JWTs. The result is a fork with a clearer front door, while its broader access model still looks intentionally internal and uncomplicated.
For readers curious about the product's implementation and next moves, GitHub is the place to dig deeper.
What's in it
- CarbonIQ identity Mike has been reskinned under the CarbonIQ name for CarbonLeo's own use.
- Vercel deployment The fork has been moved onto Vercel as its hosting platform.
- Logged-in access Authentication has progressed from a basic internal-user arrangement to Supabase JWT-based login.
Direction
brandinginfrastructuresecurity
Activity
Threads of work (detailed view)
clapointe-carbonleo turns Mike into a CarbonIQ storefront on Vercel
This fork is less an upstream upgrade than a branded deployment choice with a useful hosting lesson inside it.
clapointe-carbonleo moves Mike off Cloudflare and onto Vercel
A CarbonLeo team rehosts its Mike fork on a new platform, reskins it in-house, and rips out login to get there fast.
PR #1: CarbonIQ rebrand, auth removal, and Cloudflare-to-Vercel swap bundled in a self-merge
clapointe-carbonleo landed four commits as a single self-merged PR: a UI reskin under the CarbonIQ brand, a complete auth strip-out, an unrelated SQL addition, and a frontend hosting switch from Cloudflare to Vercel. None of the four changes were individually reviewed before merge.
clapointe-carbonleo starts rebuilding Mike Legal's front door
The fork restores sign-in and token checks after briefly removing access controls, but its permissions model is still unsafe.
clapointe-carbonleo bolts a real front door onto Mike - but leaves the inner rooms unlocked
CarbonLeo's internal fork now demands a real login, yet anyone who gets in can still see everything.
Auth stripped to a hardcoded stub, then partially rebuilt on Supabase JWT
clapointe-carbonleo gutted upstream auth in one commit, re-added a real login page in a second, then restored JWT verification in a third - but never fixed the backend access helpers. The result is a codebase where users authenticate with real tokens but every authorization check returns true for every request.
clapointe-carbonleo closes a Next.js security gap
A targeted web-framework update addresses a reported vulnerability, but leaves the upgrade only partly buttoned up.
Pull requests (detailed view)
✅ Merged (1)
clapointe-carbonleo · opened 6mo ago · merged 6mo ago by clapointe-carbonleo ⛔ Closed without merge (1)
clapointe-carbonleo · opened 5mo ago · closed 5mo ago