SecureBit.chat - P2P Encrypted Messenger Files

Security review follow-up. The end-to-end cryptography (ECDH, AES-GCM, PBKDF2, SAS bound to DTLS fingerprints, anti-replay) was verified sound; these changes fix availability/integrity defects on the send path and tighten transport headers and logging.

Fixed

• Outgoing messages were silently rejected by an over-broad keyword blocklist in _validateInputData. Plain words such as "constructor", "global", "document.", "prototype", or the literal text "javascript:" caused sendSecureMessage to throw, so legitimate messages never reached the peer. The blocklist added no real protection — XSS is enforced at the rendering boundary by the receive-side DOMPurify pass and by sanitizeMessage() before encryption — and was removed.
• _sanitizeInputString collapsed all whitespace, destroying multi-line messages and code snippets. Newlines, tabs and indentation are now preserved; only control characters are stripped.
• AAD validation failures no longer log the raw AAD (which carried sessionId and keyFingerprint); only its length is logged.

Security

• Added Strict-Transport-Security (2-year, includeSubDomains, preload) to nginx and .htaccess.
• Added a restrictive Permissions-Policy (camera kept for in-page QR scanning; microphone, geolocation, payment, usb and sensors denied).

Tests

• Added tests/outgoing-message-integrity.test.mjs (16 suites total, all passing).

Housekeeping

• Synchronized the version string (4.8.13) across package.json, package-lock.json, manifest.json, index.html, meta.json, README, SECURITY_DISCLAIMER, the site header and the in-app init banner.