DorianandClaude Opus 4.6 6425b2f53b fix(app): restrict postMessage origin in archyBridge ...

Change default allowedOrigin from '*' to null. Derive from
window.location.origin when init() is called without explicit origin.
Always validate event.origin — reject messages when origin is not set.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-06 01:31:45 +00:00

..

.storybook

feat(devx): developer experience & quality (M19.1-M19.8)

2026-03-04 01:15:39 +00:00

dev-dist

fix(app): add dev server auth token to all API endpoints

2026-03-06 01:23:17 +00:00

e2e

feat(devx): developer experience & quality (M19.1-M19.8)

2026-03-04 01:15:39 +00:00

public

feat(app): update PWA icons to ✦ star design and fix chat panel default

2026-03-02 23:49:31 +00:00

scripts

fix(app): add dev server auth token to all API endpoints

2026-03-06 01:23:17 +00:00

server

fix(app): replace CORS Access-Control-Allow-Origin * with explicit localhost origin

2026-03-06 01:25:10 +00:00

src

fix(app): restrict postMessage origin in archyBridge

2026-03-06 01:31:45 +00:00

src-tauri

feat(app): add Tauri desktop build scaffold

2026-03-03 21:07:22 +00:00

eslint.config.js

feat(app): add error boundaries and fix ESLint config for Vue+TS

2026-03-03 19:40:22 +00:00

index.html

fix(app): passphrase dialog — remove CSP meta, check crypto.subtle availability

2026-03-05 06:58:55 +00:00

lighthouserc.json

feat(devx): developer experience & quality (M19.1-M19.8)

2026-03-04 01:15:39 +00:00

package.json

fix(app): replace custom HTML sanitizer with DOMPurify

2026-03-06 01:30:58 +00:00

playwright.config.ts

feat(devx): developer experience & quality (M19.1-M19.8)

2026-03-04 01:15:39 +00:00

tsconfig.json

feat(app): redesign magazine grid, improve article views and proxy

2026-03-02 23:50:46 +00:00

vite-dev-chats.ts

fix(app): add body size limit to dev-chats write endpoint

2026-03-06 01:27:35 +00:00

vite-fs.ts

fix(app): block sensitive file reads in filesystem API

2026-03-06 01:26:01 +00:00

vite-music-search.ts

fix(app): replace CORS Access-Control-Allow-Origin * with explicit localhost origin

2026-03-06 01:25:10 +00:00

vite-rss.ts

fix(app): add SSRF protection to RSS fetcher

2026-03-06 01:27:08 +00:00

vite-tmdb.ts

fix(app): replace CORS Access-Control-Allow-Origin * with explicit localhost origin

2026-03-06 01:25:10 +00:00

vite-web-search.ts

fix(app): replace CORS Access-Control-Allow-Origin * with explicit localhost origin

2026-03-06 01:25:10 +00:00

vite.config.ts

feat(app): video player, guide page, free films, PWA cache fix

2026-03-06 00:56:39 +00:00

vitest.config.ts

feat(app): content detection overhaul, apps tab, chat UX, web search

2026-03-04 05:03:03 +00:00