SecureBitChatVolodymyr
0691ce618c
The badge image is vendored rather than hotlinked from snapcraft.io. The CSP is img-src 'self' data: and would block it anyway, but the reason to leave the CSP alone is the page's own claim: fetching a badge from someone else's server hands them the address of every visitor to a page that says no servers are involved. The README badge stays dynamic — it reports the published version, and GitHub proxies images, so no reader is exposed by it.
27 lines
975 B
Plaintext
27 lines
975 B
Plaintext
.git
|
|
.github
|
|
node_modules
|
|
tools
|
|
tests
|
|
Dockerfile
|
|
.dockerignore
|
|
fly.toml
|
|
*.log
|
|
.DS_Store
|
|
**/.DS_Store
|
|
# Source maps are debug-only and never needed at runtime; excluding them keeps the
|
|
# build context small (the .map files are several MB) and the deploy upload fast.
|
|
**/*.map
|
|
# Marketing screenshots are referenced only from the README, not served by the app.
|
|
assets/screenshots
|
|
# ...with one exception. The desktop client's store screenshots ARE fetched from
|
|
# this domain: its AppStream metainfo names them by URL, and both Flathub's
|
|
# reviewers and the store listing load them over HTTPS. Excluded, they 404 and
|
|
# the submission is rejected. Only the desktop-* set ships; the README's
|
|
# full-size marketing captures stay out of the image, which is what the rule
|
|
# above was for.
|
|
!assets/screenshots/desktop-*.png
|
|
# The Snap Store badge is served from this origin so the page makes no
|
|
# third-party request; it has to actually ship for that to be true.
|
|
!assets/badges/*.svg
|