shelem

T

goyban 1149687e3c Security hardening: escape names in result screens, drop tech-stack headers

- Escape player names rendered via innerHTML on the hand-over and game-over
  score rows (defense-in-depth XSS; names are already capped at 16 chars)
- app.disable('x-powered-by') to stop advertising Express
- Add safe response headers: X-Content-Type-Options, X-Frame-Options,
  Referrer-Policy (no CSP — inline SW script + socket.io would need unsafe-inline)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-08-16 12:42:14 +00:00

public

Security hardening: escape names in result screens, drop tech-stack headers

2026-08-16 12:42:14 +00:00

.env.example

Initial commit: Shelem card game

2026-05-08 16:17:37 +00:00

.gitignore

Fix widow/play bugs, exit-anywhere; rework leaderboard + add game history

2026-07-05 12:29:16 +00:00

compose.build.yml

Fully containerized