fs 35a36f1144 fix(security): replace innerHTML with safe DOM APIs, add destroy() cleanup ...

Replace innerHTML assignments in app-tabs.js and app-password-toggle.js
with createElement/appendChild to prevent potential XSS vectors. Add
destroy() methods to app-tabs, app-filter-drawer, and
app-toggle-aside-panels so document/window-level listeners can be
properly removed when components are torn down.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-13 22:35:01 +01:00

..

brand

baseline

2026-02-04 23:31:53 +01:00

css

refactor: extract shared form utils, add aria-live regions and reduced-motion support

2026-03-13 22:28:46 +01:00

favicon

Rename app branding from IMVS to CoreCore

2026-03-11 20:11:01 +01:00

js

fix(security): replace innerHTML with safe DOM APIs, add destroy() cleanup

2026-03-13 22:35:01 +01:00

vendor

add composer-unused, comprehensive docs, and project restructure

2026-02-22 15:27:35 +01:00

.htaccess

baseline

2026-02-04 23:31:53 +01:00

index.php

fix: dismiss stale session-timeout flash on auto-login, resolve PHPStan and i18n issues

2026-03-13 18:56:19 +01:00