You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Thomas Joise 4cf513d528 fix(sec/d24): PDF render hardening — strict CSP + request interception ... Red-team XSS/rendering finding (public-share renders our HTML in Chromium): - Both letterhead templates get a strict CSP meta (default-src none; img-src data:; style-src unsafe-inline; base-uri/form-action none) — permits the inline CSS + data: logo the templates actually use, blocks all script execution and every outbound/file fetch. Identical in preview + PDF, so the byte-for-byte preview-fidelity golden test still passes. - renderPdf aborts every non-data: network request at the browser layer. Together an esc() miss becomes a harmless rendering glitch instead of an SSRF/exfiltration/RCE-adjacent vector. Template + fidelity tests green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		4 days ago
..
scripts	feat(d20): importer v2 rework from the 46-agent real-data audit	4 days ago
src	fix(sec/d24): PDF render hardening — strict CSP + request interception	4 days ago
test	fix(sec/d24): concurrency + workflow isolation	4 days ago
.env.example	chore: commit pending working-tree improvements (env doc + headless-Chromium container flags)	4 days ago
build-server.mjs	feat(hq): server assembly, build script and e2e smoke (HQ-1 task 14)	2 weeks ago
package.json	feat(d20): P4 — full-APEX importer v2 (9 files, stage/commit, CLI)	4 days ago
schema.sql	docs+chore: HQ DDL snapshot, gitignored import-drop, Postgres locked pre-go-live (D15)	2 weeks ago
tsconfig.json	feat(hq): app skeleton with health endpoint (HQ-1 task 1)	2 weeks ago