implementer 86aa3afbbf refactor: newsletter signup posts no credential (SEC-14-R1 option a) ...

Rework PR #15 per security review SEC-14-R1: the client no longer carries
an API token. js/newsletter-config.js ships only the non-secret endpoint,
enforced https-only at config load time via validateEndpoint() (mirroring
the protocol allowlist in js/reading-list.js); js/newsletter.js POSTs
email-only with no Authorization header. Failure paths keep the single
user-safe message that never leaks token, endpoint, status, or raw body;
success still shows the confirmation. CI gains a gitleaks step that fails
on any secret hit; README documents the server-side token, the residual
signup-abuse risk, and the authoritative server-side validation follow-up.

2026-08-26 11:27:11 +00:00

..

contact.js

feat: wire contact form submit to open mail client via mailto

2026-08-25 10:45:23 +00:00

mailto.js

feat: add pure mailto URL builder

2026-08-25 10:45:17 +00:00

newsletter-config.js

refactor: newsletter signup posts no credential (SEC-14-R1 option a)

2026-08-26 11:27:11 +00:00

newsletter.js

refactor: newsletter signup posts no credential (SEC-14-R1 option a)

2026-08-26 11:27:11 +00:00

reading-list.js

feat: harden external reading links with rel="noopener noreferrer"

2026-08-25 15:15:31 +00:00