`CHANGES.md`

27 lines

## Applied

- `dashboard.js:17` — added a tiny HTML/attribute escaping helper — needed before using template `innerHTML` with stored records.
- `dashboard.js:39` — escaped rental card fields, image attributes, slugs, chips, address text, and host names — prevents malicious `localStorage` records from injecting markup.
- `dashboard.js:149` — escaped inquiry inbox names, email text, dates, events, street labels, and data attributes — prevents stored inquiry fields from rendering as HTML.
- `dashboard.js:193` — escaped photo picker labels/values and photo `src` attributes — keeps stored rental/photo metadata inside attributes/text.
- `browse.js:7` — added the same escaping helper — needed for the browse card renderer.
- `browse.js:44` — escaped browse card image attributes, chip text, address/city fields, and host names; encoded the map query — prevents stored rental data injection.
- `rental.js:35` — added HTML/attribute escaping helpers — needed for dynamic rental templates.
- `rental.js:89` — escaped trailer and cover fields from stored address, host, and venue data — prevents injected markup during trailer playback.
- `rental.js:329` — escaped the property card subline while preserving its `<br>` layout — prevents address/county markup injection.
- `rental.js:383` — escaped nearest-venue headline, name, sports, drive minutes, and date chip fields — prevents venue string injection in the event grid.
- `rental.js:503` — escaped drive-meta minutes, contact heading host name, footer host name, countdown banner text, closest-event text, and inquiry thank-you fields — closes remaining touched `innerHTML` paths fed by stored/user data.

## Deferred (needs Steve)

- P0 — `signup.js:217` — email verification is hardcoded as `verified: true` — requires backend accounts, signed email tokens, and ownership rules.
- P0 — `rental.js:735` — guest inquiries save only to visitor `localStorage` — needs backend/email delivery and failure UX.
- P0 — `network.js:33` — network viewer exposes IPs, hostnames, service names, and ports — removal/gating needs a deploy/access decision.
- P0 — `signup.js:263` — demo seed contains Steve's real-looking contact/address fixture — content/PII cleanup needs Steve.
- P1 — `signup.js:219` — slug collisions overwrite rentals — durable handling belongs with server-side claim rules.
- P1 — `signup.js:9`, `rental.js:3` — schema mismatch wipes stored data — migration/backup behavior touches user data.
- P1 — `dashboard.js:220` — photo uploads can exceed `localStorage` quota — storage migration is larger than a surgical safe fix.
- P1 — `schedule.js:5` — venue data is duplicated — shared-data refactor is outside the safe list.
- P1 — `test-e2e.js:12` — smoke test depends on live Nominatim and sleeps — test changes were out of scope.
- P1 — `network.js:28` — `no-cors` polling can show false green health — needs a same-origin proxy or removal decision.