thePR0M3TH3ANandClaude Fable 5 6b10f0b902 Fix live login: allow WASM compilation under the deployment CSP ...

script-src 'self' alone forbids WebAssembly.compile, and Argon2id
(hash-wasm) compiles a WASM module in the crypto worker -- so the CSP
added in the second-audit hardening broke every password flow on the
deployed site. Add 'wasm-unsafe-eval', which permits WASM compilation
only; JS eval stays banned, and the policy test now pins both facts so
neither can regress silently.

Co-Authored-By: Claude Fable 5 <[email protected]>

2026-08-04 09:55:49 -04:00

..

core

Pin that pre-removal passwords still sign in

2026-07-31 22:04:01 -04:00

demo

Demo guide and llms.txt: document the extension sign-in method

2026-08-04 09:41:17 -04:00

widget

Fix live login: allow WASM compilation under the deployment CSP

2026-08-04 09:55:49 -04:00