Mehboob Khan
11a709744e
Some checks failed
CI / build (push) Has been cancelled
F-03: the legacy markup's 77 onclick="" attributes were the reason script-src still needed 'unsafe-inline', which let injected inline script/handlers run right past the policy. Migrated them to data-page/data-action markers handled by a single delegated click listener in siteController.js, dropped 'unsafe-inline' from script-src, and switched both server/index.mjs and vercel.json from Content-Security-Policy-Report-Only to enforcing. style-src keeps 'unsafe-inline' — that governs inline style="" attributes used throughout, a separate CSS-injection concern out of scope here. Verified against the built site with a real headless-Chromium run: nav, company dropdown, mobile menu, the demo modal (open/close/overlay-click/ inner-click), the modal's contact-page link, and the scroll-hint all still work, with zero console errors. F-10: confirmed via npm audit fix --dry-run that no non-breaking update remains (vite and react-router-dom both need a major bump, left deferred). Added npm audit to CI — full report for visibility, gated on critical only so it doesn't block on the already-tracked moderate/high advisories. F-11: uploaded PDFs now serve with Content-Disposition: attachment instead of rendering inline from the site's own origin. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>