Potential fix for code scanning alert no. 1: DOM text reinterpreted as HTML

[stephenlyons18]

Potential fix for https://github.com/stephenlyons18/stephenlyons18.github.io/security/code-scanning/1

The best way to fix this vulnerability is to prevent user-supplied input from being interpreted as executable HTML by the browser. Specifically:

• Use textContent (or equivalent) instead of innerHTML when inserting user input into the DOM, as textContent treats its content as plain text, escaping any meta-characters.
• Alternatively, explicitly sanitize or encode the user input before using it in an HTML context, for example by replacing characters like <, >, and & with their HTML entities.
• To maintain the output format (with bold names and quoted subjects), construct the DOM elements programmatically rather than relying on string interpolation and innerHTML.

Region to change: Lines 65-72. Instead of constructing a string with interpolated user input and assigning it to formResponse.innerHTML, build the elements using the DOM API. Create and append elements such as <p>, <strong>, etc., and set user data using textContent.

No new imports are required.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

🔐 Secret Scanning Alert

TruffleHog has detected potential secrets in this pull request!

Action Required: Please review the findings and:

1. Remove any committed secrets
2. Rotate any exposed credentials
3. Update your code to use environment variables or secrets management

Common Secret Types:

• AWS Access Keys (AKIA...)
• API Keys and Tokens
• Private SSH Keys
• Database Passwords
• OAuth Tokens

How to Fix:

# Remove secret from git history
git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch path/to/file" \
  --prune-empty --tag-name-filter cat -- --all

# Use environment variables instead
export API_KEY="your-secret-key"

# Or use GitHub Secrets in Actions

Prevention:

• Use .gitignore for sensitive files
• Use pre-commit hooks with TruffleHog
• Store secrets in GitHub Secrets or a secrets manager
• Never commit .env files

View detailed findings in the Actions tab.