From ae2ab889887365028f985ceaeb361cd5db261bfb Mon Sep 17 00:00:00 2001
From: Jake Jarvis <jake@jarv.is>
Date: Sat, 3 Oct 2026 08:17:35 -0400
Subject: [PATCH] fix: disable better-auth update-user endpoint

Names and avatars come from GitHub at sign-up; prevent signed-in users
from renaming themselves to impersonate other commenters.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 lib/auth.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/auth.ts b/lib/auth.ts
index 3f3a7c30..55eaeb22 100644
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -15,6 +15,8 @@ export const auth = betterAuth({
     schema,
   }),
   plugins: [dash(), nextCookies()],
+  // names and avatars come from GitHub at sign-up; don't let users rename themselves (e.g. to impersonate someone)
+  disabledPaths: ["/update-user"],
   socialProviders: {
     github: {
       clientId: process.env.GITHUB_CLIENT_ID!,