You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Thomas Joise 4cf513d528 fix(sec/d24): PDF render hardening — strict CSP + request interception ... Red-team XSS/rendering finding (public-share renders our HTML in Chromium): - Both letterhead templates get a strict CSP meta (default-src none; img-src data:; style-src unsafe-inline; base-uri/form-action none) — permits the inline CSS + data: logo the templates actually use, blocks all script execution and every outbound/file fetch. Identical in preview + PDF, so the byte-for-byte preview-fidelity golden test still passes. - renderPdf aborts every non-data: network request at the browser layer. Together an esc() miss becomes a harmless rendering glitch instead of an SSRF/exfiltration/RCE-adjacent vector. Template + fidelity tests green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		4 days ago
..
hq	fix(sec/d24): PDF render hardening — strict CSP + request interception	4 days ago
hq-web	feat(d22): P2 — onboarding checklist per project + Projects (Onboarding) board	4 days ago