sneak e557f21bb0 harden: key remembered site permissions by full origin (closes #402) ...

allowedSites and deniedSites held the bare hostname, so a grant to
https://dapp.example also authorised http://dapp.example and every port
on that host, and the connection, transaction and signature prompts
named only the hostname. Both lists now store and match the full origin
(scheme://host[:port]), the key the connections approved without
Remember already used. The prompts, the Settings site lists and
AUTISTMASK_REMOVE_SITE use the origin too. Entries saved by hostname
are not migrated (pre-1.0): they match no site.

Model: opus-5-5

2026-10-04 15:43:58 +00:00

..

firefox

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 15:43:58 +00:00

Dockerfile

build: run the browser e2e suites in CI (closes #259)

2026-08-17 08:52:26 +02:00

harness.js

feat: vendor and censor the phishing blocklist at build time (closes #219)

2026-08-17 10:05:56 +02:00

network.js

harden: escape every interpolation into popup innerHTML, and add default-src to both manifests (closes #307)

2026-08-20 13:47:28 +02:00

run.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 15:43:58 +00:00

storagePartition.js

release: produce a versioned per-browser artifact and pin the Chrome extension id (closes #310)

2026-08-23 16:13:22 +02:00