goyban 1149687e3c Security hardening: escape names in result screens, drop tech-stack headers ...

- Escape player names rendered via innerHTML on the hand-over and game-over
  score rows (defense-in-depth XSS; names are already capped at 16 chars)
- app.disable('x-powered-by') to stop advertising Express
- Add safe response headers: X-Content-Type-Options, X-Frame-Options,
  Referrer-Policy (no CSP — inline SW script + socket.io would need unsafe-inline)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-08-16 12:42:14 +00:00

..

app.js

Security hardening: escape names in result screens, drop tech-stack headers

2026-08-16 12:42:14 +00:00

index.html

Show app version in lobby footer; expose version via /api/config

2026-07-05 19:46:13 +00:00

manifest.json

Initial commit: Shelem card game

2026-05-08 16:17:37 +00:00

style.css

Add tap-to-update button on version footer to force-refresh cached assets

2026-07-11 23:07:16 +00:00

sw.js

Show app version in lobby footer; expose version via /api/config

2026-07-05 19:46:13 +00:00