florian/peggypad
Watch
1
0
Fork
You've already forked peggypad
 0
Code Issues Pull requests Projects Releases 11 Packages Wiki Activity Actions

Visible provenance footnote; plain HTTP only within the local network #10

Merged
florian merged 1 commit from privacy-hardening into main 2026-10-05 16:29:36 +02:00
Conversation 0 Commits 1 Files changed 12 +167 -29
florian commented 2026-10-05 16:29:30 +02:00
Owner
Copy link

Summaries end with a readable footnote (model, host, time, a reminder to
check the facts) instead of a hidden HTML comment, so whoever shares or
receives the file can see what it contains. The app's own "written by a
language model" note is dropped in favour of it.

Plain http:// endpoints are only accepted for this device, RFC 1918 and
IPv6 unique-local addresses, and private TLDs (.lan, .home, .corp,
.internal, .home.arpa, .local). Settings refuses anything else with an
explanation. Before every plain-HTTP request the host is resolved and
the request refused if any address is public. HTTPS is unaffected.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

Summaries end with a readable footnote (model, host, time, a reminder to check the facts) instead of a hidden HTML comment, so whoever shares or receives the file can see what it contains. The app's own "written by a language model" note is dropped in favour of it. Plain http:// endpoints are only accepted for this device, RFC 1918 and IPv6 unique-local addresses, and private TLDs (.lan, .home, .corp, .internal, .home.arpa, .local). Settings refuses anything else with an explanation. Before every plain-HTTP request the host is resolved and the request refused if any address is public. HTTPS is unaffected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Summaries end with a readable footnote (model, host, time, a reminder to
check the facts) instead of a hidden HTML comment, so whoever shares or
receives the file can see what it contains. The app's own "written by a
language model" note is dropped in favour of it.

Plain http:// endpoints are only accepted for this device, RFC 1918 and
IPv6 unique-local addresses, and private TLDs (.lan, .home, .corp,
.internal, .home.arpa, .local). Settings refuses anything else with an
explanation. Before every plain-HTTP request the host is resolved and
the request refused if any address is public. HTTPS is unaffected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
florian deleted branch privacy-hardening 2026-10-05 16:29:36 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
florian/peggypad!10
No description provided.