2 Commits

Include renames

Author	SHA1	Message	Date
sandrodachandClaude Opus 5.5	b2ecda9896	fix(security): safe links and security headers (FLAW-28, FLAW-29) ... safeHref lets only http, https and mailto become links (Markdown viewer, outliner, legal links); javascript: and friends show as text. A middleware sets a Content-Security-Policy (scripts only from MindSift, no framing, connections only to this server), X-Frame-Options, nosniff, Referrer-Policy and a Permissions-Policy. The two inline scripts of index.html moved to files so script-src stays 'self'. The second inline script also deleted every cache on each page load, which undermined the offline start; it is gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 19:02:13 +01:00
sandrodachandClaude Opus 5.5	d6c70d7a8e	feat(legal): imprint & privacy notices, "Über MindSift" ... - LEGAL_IMPRINT_/LEGAL_PRIVACY_ URL and Markdown (inline or *_FILE); only http(s) URLs accepted - /auth/status exposes legal info; public GET /legal/{imprint|privacy} - Links on login/setup screen and in the settings footer: URL opens a new tab, Markdown a reading modal; hidden when nothing is configured - "Über MindSift" modal (version, license, repository) in settings and help - Docs and compose/env examples Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 23:10:27 +01:00