Claude e7ecd2617e fix(security): harden dashboard auth timing, XSS, and CSP ...

- Fix timingSafeCompare to pad buffers to equal length before comparing,
  closing the content timing side-channel on length mismatch
- Replace innerHTML with textContent for error messages to prevent XSS
- Extract inline script from dashboard/index.html into dashboard/app.js
- Remove 'unsafe-inline' from script-src CSP directive
- Update security test to match new CSP policy

https://claude.ai/code/session_01GfwUNbgeMgXreFDbsNQMsS

2026-02-19 20:53:15 +00:00

..

app.js

fix(security): harden dashboard auth timing, XSS, and CSP

2026-02-19 20:53:15 +00:00

domUtils.js

feat(security): migrate dashboard innerHTML to safe DOM APIs

2026-02-14 23:05:24 +00:00

index.html

fix(security): harden dashboard auth timing, XSS, and CSP

2026-02-19 20:53:15 +00:00

styles.css

feat: support platform and model info in nostr lock events

2026-02-15 20:18:59 +00:00