pad/internal at 204d63151f206c24ab5b101469b6c9bf0d4e4481 - pad

mirror of https://github.com/PerpetualSoftware/pad.git synced 2026-10-03 12:10:31 +00:00

Files

T

xarmian 204d63151f feat(server): strict-dynamic CSP + fail-fast missing index.html (TASK-375) (#172 )

Completes the remaining items on the nonce-based CSP work:

1. Add 'strict-dynamic' to script-src. In CSP-L3 browsers this supersedes
   the 'self' host-list, so a future XSS that injects <script src="//evil">
   is blocked even though 'self' is still listed (kept as fallback for
   older browsers). The SvelteKit bootstrap script already dynamically
   imports the runtime chunks, which is exactly the pattern strict-dynamic
   is designed to permit.

2. Fail fast when the embedded index.html can't be read. The previous
   silent-swallow returned blank HTML to every SPA request, which is a
   broken build that the operator should notice immediately. Panic at
   startup so the server refuses to come up with a broken UI.

Parent: PLAN-643 (OSS Security Hardening).

2026-04-21 18:45:19 -04:00

cli

feat: add CLI commands for item starring (#120 )

2026-04-14 20:51:03 -04:00

collections

feat(cli): categorized template picker + interactive select (TASK-616) (#148 )

2026-04-18 06:31:24 -04:00

config

feat: add cloud infrastructure for hosted Pad (PLAN-427)

2026-04-12 17:43:40 +00:00

diff

Initial release