Snaglist 0.4.0

Added

• Show as a QR code. With GitHub set up, What is sent offers the same pre-filled new issue as a QR code,
  for a phone to open when the computer is not online, such as one being set up. It comes first when the
  computer looks offline, with the reason above the privacy statement. A long report goes in shorter: first
  without its technical details, then with the words cut to fit, and the view says what the code holds. The
  link is shown as text with Copy the link, and Download keeps the whole report. The code is dark on
  light in every theme, with a text description, and works from the keyboard. The encoder is part of
  snaglist.js, so there is still one file and no libraries. Leave it out with send: { qr: false }.
  Send a report with a QR code has the steps.
• The help centre on the web, at https://themightytrex.github.io/snaglist/help/, with search, a menu of every
  article and display settings.
• A changelog, in CHANGELOG.md, listing every version since 0.1.0.

Security

• The QR code holds only what the preview shows. Nothing typed into the page, and no email address or key,
  reaches the code (test SEC-20). The QR tests, QR-01 to QR-05, check the encoder against the design system's
  own and the view in every theme.

Size: about 128 KB, or about 40 KB compressed.

Snaglist 0.3.2

Added

• Tests. tools/test.sh runs Snaglist's security and privacy tests in a real browser, and
  tools/security-scan.sh runs the security scanners.

Changed

• Privacy statement. The review window now says what a report leaves out, and that the page title and text
  on screen are copied as they are, instead of saying no personal information is kept.

Security

The first full security check of Snaglist. Security has what was found, how each
problem was fixed and the test for it.

• Set-up tool. A shared link can no longer put a command, code or instructions into what the tool writes. The
  repository, the app details value and the language code are checked, with an error under the field.
• Choices in fields. Recorded steps and the trail no longer keep the option chosen in a list, a ticked box, a
  selected radio button or a picked suggestion: only that a choice was made, and where.
• Editable areas. Text typed into an editable area (contenteditable) is never in a report, and private parts
  inside the chosen part are left out of its text.
• Messages. Error and console messages keep each address without its query or hash, stay on one line, and
  show only the keys of a logged object.
• More keys and numbers replaced. access_token=, Authorization: Bearer, session=, pwd=, AWS key ids
  and phone numbers written with dots.
• The part's HTML. tel:, mailto: and similar links keep only their scheme, and value attributes such as
  aria-valuetext are taken out.
• GitHub. Text from the page can no longer mention anyone, break out of a code block or add a table column.
  Reports cut inside an emoji open on GitHub again.
• Safari. A very long console message no longer holds up the page while Snaglist cleans it.
• axe-core. Loaded only with its integrity hash; check.integrity gives the hash for your own copy.
• Removing Snaglist. destroy() puts back only its own wrappers, never another tool's, and takes away the
  axe-core it loaded.
• Example worker. Uses a rate limit when one is set up, refuses oversized requests before reading them, and
  stops mentions. Add a rate limit before you make it public.
• Privacy check. tools/check-private.sh catches a private word written with "TRex", and stops if it cannot
  find the repository.