This document describes the security posture of @whykusanagi/corrupted-theme as an npm package and of the live example site at https://corrupted.whykusanagi.xyz.

Email contact@whykusanagi.xyz with subject line [corrupted-theme security]. Please do not open a public GitHub issue for security-sensitive reports. Include:

• Affected file path + version (or URL path if it's a site issue)
• Reproduction steps
• Observed vs. expected behavior
• Your proposed severity

Acknowledgement within 72 hours; fixes usually within 7 days for high/critical issues.

corrupted-theme is a client-side CSS + vanilla-JS design system. It has:

• No server runtime — everything runs in the browser.
• No authentication, no user accounts, no user-generated content storage.
• No database, no cookies, no localStorage (the one exception is NSFW toggle state on the typing-animation example, which is intentionally not persisted — resets every page load per the explicit-opt-in content-rating policy).
• No secrets shipped in the tarball or deployed site. Verified by secret scan on every release.

Attack surface is therefore limited to: (1) DOM-based XSS if callers pass untrusted input through component APIs, (2) supply-chain attacks on build-time dependencies, (3) the live site's infrastructure layer.

The example site at https://corrupted.whykusanagi.xyz runs on Cloudflare Workers Static Assets. All asset responses are wrapped by worker/index.js which adds the headers listed above.

curl -sI https://corrupted.whykusanagi.xyz/ | grep -iE 'strict-transport|x-frame|x-content|referrer|permissions|content-security'

default-src 'self';
script-src 'self' 'unsafe-inline';
style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com;
img-src 'self' data: https:;
font-src 'self' https://cdnjs.cloudflare.com data:;
connect-src 'self';
frame-ancestors 'none';
base-uri 'self';
form-action 'self';
object-src 'none';

'unsafe-inline' is allowed for script and style because every example page uses inline <script>, inline onclick="..." handlers, and inline <style> blocks to keep demos self-contained and copy-pasteable. The tradeoff is accepted because:

1. Zero user input flows into the DOM (no auth, no forms, no URL-parameter reflection).
2. Every DOM write in library code uses textContent/createElement, not innerHTML.
3. The next XSS-hardening phase (if a specific attack is demonstrated) would switch to nonce-based CSP and move the inline scripts to external files.

This is a public OSS package. The repository must never contain:

• API keys, tokens, passwords
• Private URLs (staging/prod endpoints not meant for public access)
• .env files (only .env.example with placeholder values)
• OAuth credentials

If a secret is accidentally committed:

1. Revoke the secret immediately in its source-of-truth (DigitalOcean dashboard, npm, etc.)
2. Generate a new secret
3. Force-push the rewrite only if the secret hasn't left the local machine (rare) — otherwise treat it as compromised even post-rewrite
4. Audit git history for the old secret and any derived work

• examples/.env.example — template file with placeholder values (e.g. your-api-key-token). Safe to commit and deploy. Verified 2026-04-19.
• No real secrets detected by grep sweep across git-tracked files.

The package depends on three dev-only packages:

• cssnano ^7.1.2
• postcss ^8.4.0
• postcss-cli ^11.0.1

Zero runtime dependencies. The built dist/theme.min.css has no transitive JS.

CI runs npm install + npm run build on every PR. npm audit is run locally before release and any HIGH/CRITICAL findings are remediated or explicitly accepted in CHANGELOG.md.

Starting with 0.2.0, corrupted-theme is served from a Cloudflare R2-backed CDN at cdn.whykusanagi.xyz and cdn.nikkers.cc. This section documents the threat surface introduced by CDN distribution.

• Production sites: pin a specific version (@0.2.0, not @latest). Add SRI hashes per docs/CDN_CONSUMPTION.md.
• Sites the maintainer controls and updates together: @latest is acceptable.
• Don't pass user input to corrupted-theme APIs that build phrase pools. The XSS-hardening in src/** assumes upstream-controlled content.
• CSP recommendation: consumer sites should list https://cdn.{matching-root-domain} in script-src and style-src if they're loading from the CDN. Same-origin loads still benefit from explicit CSP.

• Publish flow: npm publish --access public (npm) → npm run publish-cdn (R2 + KV pointer bump)
• The publish script REQUIRES wrangler login to be current; tokens are not embedded in the script
• KV pointer is the single source of truth for @latest — bumping it is atomic
• Worker route bindings: cdn.{whykusanagi.xyz,nikkers.cc}/corrupted-theme/@latest/*. Non-@latest requests pass through to R2 directly.

Same channels as the rest of this document. See top of SECURITY.md.

• Cloudflare Workers Static Assets — security features
• OWASP Secure Headers Project
• MDN — Content Security Policy
• Project CLAUDE.md §10 (Secrets & Sensitive Files)
• Project CLAUDE.md §11 (Publishing Workflow)