cbay

@cbay_cbay_cbay Military grade collecting being built right here. 💪🏻

👩‍🍳 Security hardening pass 6/10/2026, 10:31:53 PM · @1800bobrossdotcom Quiet but important: a security review landed today and the high-impact fixes shipped with it. WHAT CHANGED (high-level, no exploit specifics) • Tightened how we verify proof-of-shipment photos on orders so a photo from one listing can’t be passed off as proof for a different order. • Added rate-limiting to the public profile lookup endpoint so the user base can’t be enumerated by a wordlist hammering /u/. • Removed a latent unsafe-HTML branch from the front-end render helper. No site code was using it, but it was a foot-gun for any future refactor. • Switched the PNG metadata stripper to a strict allowlist of safe chunks — silently kept-then-served fingerprinting chunks like tIME and pHYs now get dropped. • Added a reserved-username blocklist so nobody can register @ support, @ admin, @ payments, @ abuse, etc. and impersonate the platform in DMs or the forum. WHAT DIDN'T CHANGE • No data was exposed, no accounts were compromised, no funds moved unexpectedly. These were preventive fixes, not incident response. • Strong points already in place — parameterized SQL, HMAC-signed sessions, HttpOnly+Secure+SameSite cookies, same-origin CSRF middleware, CSP with per-request nonce, double-gated admin access, EXIF strip on upload — are documented in the audit and unchanged. TRACKED FOR LATER • Wallet proof-of-ownership (sign-a-message flow) before binding an address to a seller record — design work in progress. • Audit log of admin actions, OAuth email-confirmation, /quote rate limit, dev-only timing-safe compare cleanup. Same honor-system, no-escrow, no-fund-custody posture as always. Report anything weird at the suggestion box or DM the maintainer.

@everydaystrade @nodefnd 👀

📦 SOLD: Pre-Alpha Pack 💰 $344 🔗 ebay.com/itm/3271907779… 📊 everydays.trade @nodefnd

@StarPlatinum_ forming

What happened to crypto communities? Years ago, you'd join one, buying a token or some NFTs And have 60 people welcoming you and +100 new followers ready to interact with you. Do communities like that still exist?

@edon15676 @Nakamigos @beeple @everydaystrade @nodefnd 👀👩‍🍳

I’ll admit those Triple Boners do go hard. But those Chapter 2’s… coded iykyk

@DavidYusuf1 @veefriends @VeeFriendsCards @garyvee @EruptVeefriends crypto / align @cbay_cbay_cbay @cbay_cbay_cbay @cbay_cbay_cbay @cbay_cbay_cbay @cbay_cbay_cbay @cbay_cbay_cbay @cbay_cbay_cbay @cbay_cbay_cbay @cbay_cbay_cbay @cbay_cbay_cbay @cbay_cbay_cbay @cbay_cbay_cbay

Holly Molly! What’s going to happen to 2025 Erupts since those were the originals. To me the original is the original thoughts…. @veefriends @VeeFriendsCards @garyvee @EruptVeefriends

@flat__stan 👀mom

Custom clear DirtyWave M8 case

hi frens, another round of updates: UPLOAD PRIVACY — EXIF / GPS STRIPPING • Phone photos commonly embed GPS coordinates, camera serial numbers, and original capture timestamps in EXIF metadata. Until today, those rode along with every image uploaded to cbay's public CDN. • Every image now goes through a zero-dependency server-side stripper before it hits Blob storage. JPEG APPn / COM segments, PNG eXIf / tEXt / iTXt / zTXt chunks, and WebP EXIF / XMP chunks are all dropped. Image pixels are untouched — only the metadata sidecar is removed. • Sellers no longer have to remember to scrub their photos. The strip happens automatically for new uploads going forward. ACCESSIBILITY • Every listing image now ships with descriptive alt text — thumbnails, the modal hero, packing photos, sell-form previews, avatars, and banners. Screen readers and image-fallback views can finally describe what's on screen. • The remove-image (×) and remove-link (✕) icon buttons got aria-labels so they're no longer announced as just "button". • The header search box, category dropdown, and search button are now properly labeled, and the two navigation bars (categories + site sections) are landmarked so keyboard / screen-reader users can jump straight to them. *audio on 😄

@jpegflipflops @beeple @spacebarSix9

@cbay_cbay_cbay @beeple @spacebarSix9 Bangers

Pika Pika Pack ⚡️ @beeple EVERYDAYS ALPHA CARDS. 4 Basic #Pikachu cards. 1 SIGNED — $2500.69 by @spacebarSix9 on @cbay_cbay_cbay (pays in ETH) cbay.ing/l/lst_mq77c5zs…

@ronnielighto 👀

This project has only been out since March. David Choe prints money.

@spacebarSix9 @beeple continually working here to make this a continually better experience - excited for the next big ui/ux update and more. thanks for being an early adopter and for the trust. means the world! bootstrapping and determined

@cbay_cbay_cbay @beeple Appreciate it! Thanks for the repost.

Selling a PIKA Pack with a signed Pokémon Zero @beeple Everydays card in the Lot.

Gm Shipped Updates: Have multiples of the same item? Now you can list quantities! See here for full details: #updates" target="_blank" rel="nofollow noopener">cbay.ing/#updates Updated descriptors for items. Updated skin section. Fixed mojibake. Added favicon.

@MadeByWoven , absolutely beautiful work @MadeByWoven

*posts a pokemon hoodie to reddit *post blows tf up *redditors report my piece DIRECTLY to pokemon

You wanna fucking win in life? Fall in love with losing, because most people are scared of it.

@wsavas 💜💜💜📈👀

The team at @cbay_cbay_cbay is cooking and has some exciting new updates coming… Pay attention 👀

CLASSIC

NEON

dev's are c00king working on many site updates as we audit and improve cbay. much bae. much cbuying 👀