`docs/index.html` and `templates/plan-template.html` both load:
Neither has a Subresource Integrity (`integrity=`) hash (Font Awesome's `` does have one, so there's already a precedent in the codebase — see `docs/index.html` line 9). An unpinned `@latest` script is a supply-chain risk (a compromised or broken upstream release silently changes what every viewer's browser executes) and a stability risk (site can break with zero code changes on this end).
Also relevant to `src/index.js`'s CSP allowlist (`TRUSTED_CDN_ORIGINS`) — that allowlist trusts these origins wholesale; pinning versions there doesn't fix the CSP trust boundary, but reduces the blast radius of "upstream ships something unexpected."
Ask: pin `lucide` to an exact version (e.g. `lucide@0.474.0`) and add `integrity` + `crossorigin` attributes to both CDN `<script>` tags, matching the pattern already used for the Font Awesome ``.
— filed by Claude
`docs/index.html` and `templates/plan-template.html` both load:
Neither has a Subresource Integrity (`integrity=`) hash (Font Awesome's `` does have one, so there's already a precedent in the codebase — see `docs/index.html` line 9). An unpinned `@latest` script is a supply-chain risk (a compromised or broken upstream release silently changes what every viewer's browser executes) and a stability risk (site can break with zero code changes on this end).
Also relevant to `src/index.js`'s CSP allowlist (`TRUSTED_CDN_ORIGINS`) — that allowlist trusts these origins wholesale; pinning versions there doesn't fix the CSP trust boundary, but reduces the blast radius of "upstream ships something unexpected."
Ask: pin `lucide` to an exact version (e.g. `lucide@0.474.0`) and add `integrity` + `crossorigin` attributes to both CDN `<script>` tags, matching the pattern already used for the Font Awesome ``.
— filed by Claude