From a7663b3a5ed3d7c269c04420f9351c42f7618189 Mon Sep 17 00:00:00 2001
From: saphid <4596216+saphid@users.noreply.github.com>
Date: Mon, 28 Sep 2026 14:51:18 +1000
Subject: [PATCH] Website feedback: double backslashes so escapes can't rebuild
 references; queue every approval

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/approve-contributor.yml | 1 +
 site/lib/feedback.js                      | 4 +++-
 site/test/feedback.test.mjs               | 1 +
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/approve-contributor.yml b/.github/workflows/approve-contributor.yml
index 68cc7fd..9cf74ec 100644
--- a/.github/workflows/approve-contributor.yml
+++ b/.github/workflows/approve-contributor.yml
@@ -18,6 +18,7 @@ jobs:
     concurrency:
       group: approve-contributor
       cancel-in-progress: false
+      queue: max
     runs-on: ubuntu-latest
     permissions:
       contents: write
diff --git a/site/lib/feedback.js b/site/lib/feedback.js
index d697474..698575d 100644
--- a/site/lib/feedback.js
+++ b/site/lib/feedback.js
@@ -21,10 +21,12 @@ const oneLine = (value, max) => String(value ?? "").replace(/\s+/g, " ").trim().
 // (#1, owner/repo#1, GH-1, github.com links) would add backlinks to other
 // people's issues, so break them all with a zero-width space. Escaping & first
 // stops &commat; and &num; from turning back into @ and # when GitHub renders,
-// and escaping < keeps out raw HTML such as an unclosed <!-- comment.
+// escaping < keeps out raw HTML such as an unclosed <!-- comment, and doubling
+// backslashes stops GH\-1 or github\.com from being unescaped back into references.
 const ZWSP = "\u200b";
 export function defang(text) {
   return text
+    .replace(/\\/g, "\\\\")
     .replace(/&/g, "&amp;")
     .replace(/</g, "&lt;")
     .replace(/@(?=[A-Za-z0-9])/g, `@${ZWSP}`)
diff --git a/site/test/feedback.test.mjs b/site/test/feedback.test.mjs
index 5a2621b..afd325b 100644
--- a/site/test/feedback.test.mjs
+++ b/site/test/feedback.test.mjs
@@ -59,6 +59,7 @@ test("breaks mentions, issue refs and table cells in user text", () => {
   assert.equal(defang("see valve/steam#7 and GH-8"), "see valve/steam#\u200b7 and GH\u200b-8");
   assert.equal(defang("&commat;valve &#64;valve &num;3"), "&amp;commat;valve &amp;#\u200b64;valve &amp;num;3");
   assert.equal(defang("end <!--"), "end &lt;!--");
+  assert.equal(defang("GH\\-1 github\\.com"), "GH\\\\-1 github\\\\.com");
   assert.equal(defang("https://github.com/a/b/issues/1"), "https://github\u200b.com/a/b/issues/1");
   const issue = buildIssue(validate(form({ os: "a | b" })).value);
   assert.match(issue.body, /\| a \\\| b \|/);