docs: close the security-review record - D12, resolution, current counts - #67
Merged
Conversation
D12 records the finding that only a real browser could surface: every header check passed and the console still logged one violation, because Angular's inlineCritical optimization ships an inline onload handler that script-src 'self' rightly blocks - leaving the full stylesheet silently print-only. The entry carries the analysis, the fix (inlineCritical off; the stylesheet is 767 bytes, so the optimization bought nothing), and the two tests that prevent recurrence: check:swa scanning the BUILT index.html for inline script, and the zero-violations browser pass after any CSP change. The deployment-status table and the SWA-outage narrative now record the resolution instead of reading as an open incident, lesson 29 gets its ending (the recovering control plane was the tell that one retry had become worth attempting), and two smoke-test counts that described the present said 27 where the suite is now 32. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Final consistency pass over the review record.
D12 — the finding only a browser could surface
Every header check passed, the site rendered — and the console still logged one violation. Angular's
inlineCriticalships an inlineonloadhandler thatscript-src 'self'rightly blocks, leaving the full stylesheet silently print-only. Recorded with:inlineCritical: false; at that size the optimization bought nothing with or without a CSPcheck:swascans the builtindex.htmlfor inline handlers and script bodies (proven to fail on the reinjected defect), and the post-CSP browser pass asserting zero console violationsAlso
🤖 Generated with Claude Code