fix(security): audit batch B — SPA CSP + vite upgrade (#21)

2026-07-02 03:24:57 +02:00
parent c5c33f7023
commit b905c93884
5 changed files with 561 additions and 1125 deletions
@@ -0,0 +1,9 @@
+// Applied before first paint to avoid a flash of the wrong theme. Lives in a file (not
+// inline) so the SPA can ship a CSP with script-src 'self' (AUDIT M-2).
+(function () {
+  try {
+    // Dark-first: default new users to dark unless they've chosen light.
+    var t = localStorage.getItem('ii:theme') || 'dark';
+    if (t === 'dark') document.documentElement.classList.add('dark');
+  } catch (e) {}
+})();