fix: remediate remaining audit security findings

.github/workflows/ci.yml

@@ -10,6 +10,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

public/sw.js

@@ -28,6 +28,20 @@ const STATIC_ASSETS = [
     ...OFFLINE_FALLBACK_CANDIDATES,
 ];
 
+const SENSITIVE_QUERY_PARAMS = [
+    'handoff',
+    'handoff_ref',
+    'token',
+    'secret',
+    'payload',
+    'key',
+    'authorization',
+];
+
+function hasSensitiveQuery(url) {
+    return SENSITIVE_QUERY_PARAMS.some((param) => url.searchParams.has(param));
+}
+
 function matchOfflineFallback() {
     return caches.match(OFFLINE_FALLBACK_URL)
         .then((cached) => cached || caches.match('/offline'))
@@ -79,6 +93,8 @@ self.addEventListener('fetch', (event) => {
     if (event.request.method !== 'GET') return;
     // Do not cache or intercept third-party requests.
     if (url.origin !== self.location.origin) return;
+    // Keep tool payloads and secret-like query strings out of CacheStorage.
+    if (hasSensitiveQuery(url)) return;
 
     // Network-first for Next.js chunks and pages (ensures fresh code)
     if (

src/core/codegen/literals.ts

@@ -0,0 +1,82 @@
+export function shellSingleQuote(value: string): string {
+    if (value.length === 0) return "''"
+    return `'${value.replace(/'/g, "'\\''")}'`
+}
+
+export function jsStringLiteral(value: string): string {
+    return JSON.stringify(value)
+}
+
+export function pythonStringLiteral(value: string): string {
+    return JSON.stringify(value)
+}
+
+export function goStringLiteral(value: string): string {
+    return JSON.stringify(value)
+}
+
+export function phpStringLiteral(value: string): string {
+    return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`
+}
+
+function rustEscapedStringLiteral(value: string): string {
+    let output = '"'
+    for (const char of value) {
+        switch (char) {
+            case "\\":
+                output += "\\\\"
+                break
+            case '"':
+                output += '\\"'
+                break
+            case "\n":
+                output += "\\n"
+                break
+            case "\r":
+                output += "\\r"
+                break
+            case "\t":
+                output += "\\t"
+                break
+            case "\0":
+                output += "\\0"
+                break
+            default: {
+                const codePoint = char.codePointAt(0) ?? 0
+                output += codePoint < 0x20
+                    ? `\\u{${codePoint.toString(16)}}`
+                    : char
+            }
+        }
+    }
+    return `${output}"`
+}
+
+export function rustStringLiteral(value: string): string {
+    for (let hashCount = 0; hashCount <= 8; hashCount += 1) {
+        const hashes = "#".repeat(hashCount)
+        const endDelimiter = `"${hashes}`
+        if (!value.includes(endDelimiter)) {
+            return `r${hashes}"${value}"${hashes}`
+        }
+    }
+
+    return rustEscapedStringLiteral(value)
+}
+
+export function jsJsonBodyExpression(value: string): string | null {
+    try {
+        return `JSON.stringify(${JSON.stringify(JSON.parse(value), null, 2)})`
+    } catch {
+        return null
+    }
+}
+
+export function pythonJsonBodyExpression(value: string): string | null {
+    try {
+        JSON.parse(value)
+        return `json.loads(${pythonStringLiteral(value)})`
+    } catch {
+        return null
+    }
+}

src/core/i18n/translations/de.json

@@ -761,7 +761,8 @@
       "strength_weak": "Schwach",
       "strength_fair": "Mittel",
       "strength_good": "Gut",
-      "strength_strong": "Stark"
+      "strength_strong": "Stark",
+      "crypto_unavailable": "Web Crypto ist erforderlich, um sichere Passwoerter zu generieren."
     },
     "color_converter": {
       "title": "Farbkonverter",

src/core/i18n/translations/en.json

@@ -781,7 +781,8 @@
       "strength_weak": "Weak",
       "strength_fair": "Fair",
       "strength_good": "Good",
-      "strength_strong": "Strong"
+      "strength_strong": "Strong",
+      "crypto_unavailable": "Web Crypto is required to generate secure passwords."
     },
     "color_converter": {
       "title": "Color Converter",

src/core/i18n/translations/fr.json

@@ -761,7 +761,8 @@
       "strength_weak": "Faible",
       "strength_fair": "Moyen",
       "strength_good": "Bon",
-      "strength_strong": "Fort"
+      "strength_strong": "Fort",
+      "crypto_unavailable": "Web Crypto est requis pour generer des mots de passe securises."
     },
     "color_converter": {
       "title": "Convertisseur de couleurs",

src/core/i18n/translations/ja.json

@@ -761,7 +761,8 @@
       "strength_weak": "弱い",
       "strength_fair": "普通",
       "strength_good": "良い",
-      "strength_strong": "強い"
+      "strength_strong": "強い",
+      "crypto_unavailable": "安全なパスワード生成には Web Crypto が必要です。"
     },
     "color_converter": {
       "title": "カラー変換",

src/core/i18n/translations/ko.json

@@ -761,7 +761,8 @@
       "strength_weak": "약함",
       "strength_fair": "보통",
       "strength_good": "좋음",
-      "strength_strong": "강함"
+      "strength_strong": "강함",
+      "crypto_unavailable": "안전한 비밀번호를 생성하려면 Web Crypto가 필요합니다."
     },
     "color_converter": {
       "title": "색상 변환기",

src/core/i18n/translations/zh-CN.json

@@ -761,7 +761,8 @@
       "strength_weak": "弱",
       "strength_fair": "一般",
       "strength_good": "良好",
-      "strength_strong": "强"
+      "strength_strong": "强",
+      "crypto_unavailable": "需要 Web Crypto 才能生成安全密码。"
     },
     "color_converter": {
       "title": "颜色转换器",

src/core/i18n/translations/zh-TW.json

@@ -761,7 +761,8 @@
       "strength_weak": "弱",
       "strength_fair": "一般",
       "strength_good": "良好",
-      "strength_strong": "強"
+      "strength_strong": "強",
+      "crypto_unavailable": "需要 Web Crypto 才能產生安全密碼。"
     },
     "color_converter": {
       "title": "顏色轉換器",