fix(security): audit batch B — SPA CSP + vite upgrade (#21)

2026-07-02 03:24:57 +02:00
parent c5c33f7023
commit b905c93884
5 changed files with 561 additions and 1125 deletions
@@ -5,16 +5,8 @@
    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>InboxIntel — Gmail analytics & cleanup</title>
-    <script>
-      // Apply the saved theme before first paint to avoid a flash of the wrong mode.
-      (function () {
-        try {
-          // Dark-first: default new users to dark unless they've chosen light.
-          var t = localStorage.getItem('ii:theme') || 'dark';
-          if (t === 'dark') document.documentElement.classList.add('dark');
-        } catch (e) {}
-      })();
-    </script>
+    <!-- Theme applied before first paint; external file so CSP can use script-src 'self'. -->
+    <script src="/theme-init.js"></script>
  </head>
  <body>
    <div id="root"></div>