Turning a Pexels-only hero picker into a provider registry (and the review that caught a license forgery)
A routine provider-registry refactor turned up an unvalidated param that could commit a mislicensed image to the live blog as legitimately self-hostable.