Martin Vogel f7315b9bc5 Robust UI audit: skip inline URL scan on dist/, keep structural checks ...

Minified JS in dist/ contains hundreds of string-constant URLs from
bundled npm libraries (React error pages, W3C namespace URIs, CDN
references, OSS credits) that are never fetched at runtime. Scanning
them produced an endless stream of false positives requiring per-URL
allowlisting.

Fix: split the A1 URL check by directory:
- src/ (our code): strict — any external URL is blocked
- dist/ (npm build output): skip inline URL scan entirely

Structural checks (A2-A6) still apply to dist/:
- External <script>/<link> loads in HTML
- Tracking/analytics identifiers
- Iframes, eval/Function, external WebSockets

2026-03-20 20:56:52 +01:00

..

hooks

Remove all Go code — project is now pure C

2026-03-15 20:32:19 +01:00

build.sh

Auto-detect WIN32_LIBS in Makefile, remove shell quoting entirely

2026-03-19 00:00:19 +01:00

clean.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

clone-bench-repos.sh

v0.5.1: Fix C/C++/CUDA/GLSL function extraction, add config linker and tests

2026-03-06 17:50:18 +01:00

embed-frontend.sh

Fix Windows build: add zip pkg, portable embed (od replaces xxd)

2026-03-19 10:59:14 +01:00

env.sh

Fix production build errors, add build step to Docker test infra

2026-03-18 17:15:46 +01:00

lint.sh

Use cc (Apple Clang) on macOS, gcc on Linux — unified CI/local parity

2026-03-18 13:08:33 +01:00

security-allowlist.txt

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

security-audit.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

security-fuzz.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

security-install.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

security-network.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

security-strings.sh

Fix security audit false positives in CI

2026-03-20 18:47:55 +01:00

security-ui.sh

Robust UI audit: skip inline URL scan on dist/, keep structural checks

2026-03-20 20:56:52 +01:00

security-vendored.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

setup-windows.ps1

Add cross-platform setup scripts and CI release workflow

2026-02-25 10:07:45 +01:00

setup.sh

Fix binary move command in setup script (#16)

2026-03-06 21:19:38 +01:00

smoke-test.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

test.sh

Auto-detect WIN32_LIBS in Makefile, remove shell quoting entirely

2026-03-19 00:00:19 +01:00

vendor-grammar.sh

Add Go LSP hybrid type resolver, config store, and supporting infrastructure

2026-03-12 13:26:13 +01:00

vendored-checksums.txt

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00