Closes #22. Read-only audit (codex) + PO line-by-line review. (#12 publish localStorage hook left as-is: deliberate owner test hook, server-authoritative.) Security (XSS-via-import/share): - meta.surface + photoShape now allowlisted like their siblings, and the body class is escAttr-escaped (hostile imported/shared meta can no longer inject a body attribute) - invalid custom accent falls back to a canonical palette color; only #rrggbb reaches CSS (was returned unchanged -> CSS injection) - imported image data URLs validated (MIME + size + base64 + magic bytes) and escAttr-escaped before entering the preview srcdoc - email links split across data attributes, assembled on click; no complete address in source, text, or a single attribute Data integrity + robustness: - page IDs use crypto.randomUUID(); duplicate stored IDs migrated on load (was length-based -> create/delete/create collision + data loss) - new complete SiteData runtime decoder validates/defaults arrays, sections, items, images, meta; applied to both saved-state load and file import (was version+name only -> links:null / links:{} crashed on load/import) - import fully replaces the draft incl lang/favicon; clears absent optionals - history: structural changes always snapshot; only same-control text edits coalesce (was 800ms blanket coalescing -> undo dropped a typed name) - persistence returns success/failure; unsaved warning shown on quota failure - AA guard fits foregrounds against both bg and surface; rejects impossible custom surface - QR enforces the version-40 byte limit with a friendly error (was uncaught throw) - OG long names wrap + grapheme-truncate below 36px (was clipped) 175 tests pass (was 157; added hostile image/look fixtures, DOM-security, decoder, history, OG, contrast, QR coverage; happy-dom dev dep for parsed-DOM assertions). typecheck passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TmgNzbG2MaXd1ckGxmuEfu

Commits

Commits on Jul 14, 2026

fix(audit): resolve 13 verified defects (import/share XSS, data integrity)