#135 Epic: July 2026 whole-app audit — findings & fixes

[Anonymous]

Originally created by: kristofferR

Tracking issue for the July 2026 whole-app audit (Rust shell, injected scripts, settings/IPC, CI/release pipeline, product surface). Only new findings are tracked here; several audit results instead reinforce existing issues: [#80] (two concrete new failure modes filed below), [#51] (scope widened below), [#58], [#28], [#23].

Verified sound during the audit, no action needed: URL-allowlist anchoring, download/SSRF filtering, avatar decode hardening, release publish atomicity, SHA-pinned actions + Dependabot coverage, updater signature verification, live settings propagation, inject bundles in sync.

Fixes in flight (PR [#136])

• [x] [#105] facebook.com content links open inside the app
• [x] [#106] AltGr-typed brackets trigger shortcuts (Windows European layouts)
• [x] [#107] Narrow remote-origin capabilities (notification, opener scope)
• [x] [#108] Enforce Mute / Hide Preview on the Rust delivery path

Notifications

• [x] [#109] Pairing misses on truncated/group-chat text → duplicates
• [x] [#110] Fallback swallowed by the auto-refresh race
• [x] [#111] Pipeline hardening: watchdog coverage, grid re-attach, characterData, click routing
• [x] [#112] Reduce the 1 Hz forced-layout poll
• [x] [#113] Verify Windows notification clicks

Privacy & page features

• [x] [#114] Cookie auto-decline can click through 2FA pages
• [x] [#115] Hide Names blur geometry assumes 100% zoom
• [x] [#116] Hide Names text-node wrapping desyncs React previews
• [x] [#117] Dead media-viewer header-height CSS rule

Security hardening

• [x] [#118] Narrow core:default for the remote origin
• [x] [#119] Update triggers only from local windows; rate-limit page events

Robustness / CI / release

• [x] [#120] Atomic settings writes; warn on corrupt settings.json
• [x] [#121] Release gate: full inject toolchain + bundle freshness
• [x] [#122] Ask before installing an update and restarting
• [x] [#123] Automate release version bumps in README/landing

Distribution

• [ ] [#124] winget
• [x] [#125] Windows code signing (or disclose unsigned)
• [x] [#126] AUR + Flathub spike

Docs

• [x] [#127] README/landing accuracy sweep

UX & features

• [x] [#128] Shortcut overlay + Help menu
• [x] [#129] First hide-to-tray notice
• [x] [#130] Stop video/GIF autoplay

i18n & a11y

• [x] [#131] Locale-independent page heuristics (beyond [#51])
• [x] [#132] A11y for injected surfaces

Tests & hygiene

• [x] [#133] Extract & test unread-bold / login-tidy logic
• [x] [#134] Inject hygiene sweep

[Anonymous]

Originally posted by: kristofferR

[!NOTE]
🤖 Claude Opus 5.5 responding on behalf of Kristoffer

Closing the audit epic: 26 of its 27 items are done. The last one, winget, stays open on its own as [#124].

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed