Proactive security & health pass. No live/exploitable vulnerabilities were
found; these changes remove information-disclosure surfaces and add
standard hardening.
- Remove publicly-downloadable 1.1 MB full source dump (code_export.txt)
and stray empty l.php; add code_export.txt to .gitignore.
- Exclude dev files/folders (*.sh, *.py, docs/, templates/, tools/,
README.md) from the rsync deploy so they never reach the live server.
- .htaccess: add X-Frame-Options, Referrer-Policy, Permissions-Policy,
and a report-only Content-Security-Policy; add defense-in-depth deny
block for dev/VCS files (robots.txt & sitemap.xml left served).
- .htaccess: fix root redirect to canonical msosorg.com + /en/.
- Swap 4 project-page YouTube embeds to youtube-nocookie.com so no
Google cookies are set before consent (GDPR).
- Add rel="noopener" to 30 team social links on the About Us pages.
- Harden esc() in my-route.js to also escape single quotes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Update the residence-permit "sufficient means" figure to 507,43 EUR/month
(Slovenian basic minimum income from 1 April 2026, source gov.si) across the
guide, FAQ, budget note, sample parent statement and my-route tip; replaces
the old 484,88 everywhere.
- New standalone news announcement page /<lang>/news/proof-of-means-updated-2026/
(trilingual), published 1 August 2026, with a clickable gov.si source box and a
hero image (Pixabay, credited). news.js now supports announcement items
(slug + body) and shows them newest-first on the homepage and News hub; the
image doubles as the card thumbnail. Optimised 6.98MB to 255KB.
- Switch English EUR amounts to European format (comma decimal, dot thousands):
507,43 / 9.600 / 1.000 etc. Only euro-prefixed amounts are touched, so SI/MK
(which use a euro suffix) are unaffected. New generator eurofmt.js.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds top spacing so the report clears the sticky nav; centers the logo/title/date into a clean report header. Print: @page margin 0 removes the browser URL/date/page-number chrome, compacts fonts/spacing, drops the non-clickable Key pages block, and adds page-break-inside:avoid so the disclaimer and other blocks no longer split across pages.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds role, faculty (typed), and budget fields; the configurator now navigates to a new per-language results page (my-route/) carrying the answers in the URL. The results page renders a branded, printable report: profile chips, tailored ordered steps, city/budget/role/level focus tips, key page links, a disclaimer, and a Save-as-PDF/print button (print CSS shows only the report). my-route.js also has a Google Form hook to collect the profile for demographics once configured.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
popovskik