Work the 2026-09-21 security audit: invisible characters, homoglyph folds, web sinks, --png scratch name - #4

Merged

bmmmm merged 8 commits into

mainfrom

worktree-security-remediate-2026-09-21

Sep 21, 2026

Commits on Sep 21, 2026

epc: refuse control and format characters in every field, escape them in --details
bmmmm
committed
d6ae48a
epc: name a non-ASCII character in IBAN, BIC and purpose instead of folding it
bmmmm
committed
902e1bf
web: insert the QR as a parsed SVG node, gate HTML string sinks in the smoke test
bmmmm
committed
93764f8
cli: give the --png scratch file a random suffix instead of the pid
bmmmm
committed
06bb7bc
web: name the download after the encoded payload, not the IBAN field
bmmmm
committed
1f10904
web: say what the browser does with a share link, not more
bmmmm
committed
c041043
epc: name a non-ASCII character in an RF creditor reference too
bmmmm
committed
721b16a
docs: describe what web-smoke.mjs gates now
bmmmm
committed
27bee68