9 Commits

Include renames

Author	SHA1	Message	Date
kpcto	1e14fc106b	Remove js/newsletter-config.js	2026-08-26 22:35:57 +00:00
kpcto	c61d77e1b3	Remove js/mailto.js	2026-08-26 22:35:52 +00:00
kpcto	657c2e7d43	Remove js/contact.js	2026-08-26 22:35:48 +00:00
implementer	86aa3afbbf	refactor: newsletter signup posts no credential (SEC-14-R1 option a) ... Rework PR #15 per security review SEC-14-R1: the client no longer carries an API token. js/newsletter-config.js ships only the non-secret endpoint, enforced https-only at config load time via validateEndpoint() (mirroring the protocol allowlist in js/reading-list.js); js/newsletter.js POSTs email-only with no Authorization header. Failure paths keep the single user-safe message that never leaks token, endpoint, status, or raw body; success still shows the confirmation. CI gains a gitleaks step that fails on any secret hit; README documents the server-side token, the residual signup-abuse risk, and the authoritative server-side validation follow-up.	2026-08-26 11:27:11 +00:00
bot-implementer	24db5b8a50	feat: add serverless newsletter signup page ... Adds newsletter.html with an email signup form that POSTs to a configured serverless endpoint. The endpoint and API token live in js/newsletter-config.js (token defaults to an empty deploy-time placeholder, never hardcoded in page logic). Missing/invalid tokens and network failures surface a fixed user-safe error; successful signups show a confirmation. Links the page from the site navigation on all pages.	2026-08-25 19:15:56 +00:00
bot-implementer	fb62194d40	feat: harden external reading links with rel="noopener noreferrer" ... All reading list links point at external http(s) URLs, so each rendered anchor now carries rel="noopener noreferrer" as a hardening best practice. Renderer test updated for the new attribute and asserts every rendered link carries it.	2026-08-25 15:15:31 +00:00
bot-implementer	ffdcd35cea	feat: add reading list renderer module ... Renders the data file as category-grouped HTML. Pure string builder with guarded browser wiring so it is unit-testable in Node; escapes all text, skips invalid entries, and handles duplicate category slugs.	2026-08-25 12:30:06 +00:00
bot-implementer	0d76bc01fe	feat: wire contact form submit to open mail client via mailto	2026-08-25 10:45:23 +00:00
bot-implementer	b99c1b27d0	feat: add pure mailto URL builder	2026-08-25 10:45:17 +00:00