style: replace default vercel favicon with custom blue-black pcompiler icon

[madara88645]

This PR replaces the default Vercel favicon with a custom blue-black themed icon for Prompt Compiler.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
compiler	Ready	Preview, Comment	May 31, 2026 10:04am

[cursor]

Stale comment

PR risk assessment

Risk level: Medium
Code review: Required
Automation approval: Not granted

Evidence-based scope (diff only)

The PR title and description describe a favicon swap, but the diff also includes substantive backend and CI changes:

Area	Change	Risk signal
api/auth.py	New IP-based rate_limit_by_ip, shared _enforce_rate_limit, X-Forwarded-For parsing, public limits (20 heavy / 60 default)	Auth-adjacent; affects all unauthenticated traffic
API routes	Depends(rate_limit_by_ip) on compile, export, RAG, agent packs, generators, benchmark	Cross-cutting behavioral change on public endpoints
.github/workflows/ci.yml	Canonical coverage artifact upload (ubuntu + py3.12 only)	Minor infra
Tests	test_api_hardening.py (+130 lines), new test_ci_workflow.py	Mitigates regression risk
web/app/	favicon.ico removed, icon.png added	Very low risk (isolated UI asset)

Note: Scope was assessed from the diff only. Claims in the title/description that this is favicon-only were not used for classification.

Why Medium (not Low / Very Low)

• Touches shared auth/rate-limiting used by many public routes.
• Introduces new production behavior (429 responses by client IP on routes that previously had no IP bucket).
• Multi-file, cross-cutting change with meaningful regression potential (proxy headers, bucket isolation, route grouping).
• Good test coverage reduces uncertainty but does not eliminate review need for security-sensitive paths.

Why not Medium-High / High

• Additive hardening rather than an auth model rewrite.
• No schema migrations, secrets handling changes, or permission model changes.
• CI change is narrow (artifact naming/matrix guard).

Actions taken

• Not approved — Medium risk requires human review before merge.
• Reviewers: No additional human reviewers were requested. The only non-bot contributor history is the PR author (madara88645); assigning the author would not satisfy independent review. Please arrange a conscious review of auth/rate-limit behavior before merge.
• CODEOWNERS: None configured in this repository.

Reviewer focus areas

1. X-Forwarded-For trust model behind reverse proxies (spoofing vs. correct client identification).
2. Public limit values (20/60 per minute) vs. legitimate burst usage.
3. Interaction between API-key rate limits and new IP buckets (shared RATE_LIMIT_STORE).
4. Confirm favicon/icon assets render correctly in Next.js App Router metadata.

---

Automated risk assessment — conclusions derived from diff evidence only.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[cursor]

PR risk assessment (re-evaluated on synchronize)

Risk level: Very Low
Code review: Not required
Automation approval: Granted

Evidence-based scope (full PR diff vs base 8777548)

File	Change
web/app/favicon.ico	Deleted (binary)
web/app/icon.png	Added (binary)

No application logic, API routes, auth, CI, tests, or infrastructure files are in this PR. Assessment uses the GitHub PR file list and git diff 8777548...e1afbbc only—not title/description claims.

Why Very Low

• Isolated static branding assets for the Next.js App Router (icon.png convention; legacy favicon.ico removed).
• Zero production behavior change; no user flows, permissions, or data paths touched.
• Minimal blast radius (browser tab / bookmark icon only).
• Easy rollback (revert two binary files).

Re-evaluation note

A prior run on an earlier commit referenced backend rate-limiting and CI changes; those paths are not in the current PR (1 commit, 2 files). Risk decreased to Very Low after the branch was narrowed to favicon-only.

Actions taken

• Approved — Very Low risk per policy.
• Reviewers: None requested (not required; no CODEOWNERS in repo).
• CODEOWNERS: None configured.

Optional human check

Confirm the new icon renders correctly on Vercel preview (tab icon, PWA if applicable).

---

Automated risk assessment — conclusions derived from diff evidence only.

  

_{Sent by Cursor Automation: Assign PR reviewers}