3 Commits

Include renames

Author	SHA1	Message	Date
Joel Brock	f85a6fb9b7	Security hardening: drop npm deps and self-host Outfit font ... - Remove package.json / package-lock.json. The only dependency was claude-flow (dev tooling, never loaded by the game), which pulled in 49 known vulnerabilities (2 critical, 28 high) and could be installed by the Cloudflare Pages build. - Self-host the Outfit variable font (latin + latin-ext woff2, SIL OFL) in fonts/ instead of loading it from Google Fonts. This removes the last third-party origins from the CSP (style-src / font-src are now 'self' only), stops sending visitor IPs to Google, and makes the font work offline. - Precache the font files in the service worker and bump CACHE_NAME to tortugotchi-v18.	2026-10-30 17:43:03 -07:00
Joel Brock	7bc83a782d	Security hardening: CSP headers, SW scope gating, save validation ... - _headers: add CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, COOP, CORP, COEP - sw.js: gate fetch handler to GET + http(s) + same-origin; return 504 on offline non-document failures; bump cache to v11 - app.js: validate every field of the localStorage save (allowlist species, clamp stats, coerce age, reject oversized payloads, strip HTML-relevant chars from name); apply same sanitizer to rename input	2026-05-27 12:41:11 -07:00
Joel Brock	f52f99b647	Add Cloudflare Pages _headers for service worker freshness	2026-05-26 16:38:50 -07:00