docs: update feedback section to use support forum

.gitea/workflows/ci.yml

@@ -8,22 +8,31 @@ on:
       - main
 
 jobs:
-  lint:
+  ci:
-    name: Lint and Test
+    name: CI
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout Source Files
         uses: actions/checkout@v4
 
-      - name: Use Node.js v22
+      - name: Use Node.js v24
         uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v2
         with:
-          version: 9
+          version: 10
+
+      - name: Ensure Dependencies are Pinned
+        uses: naomi-lgbt/dependency-pin-check@main
+        with:
+          language: javascript
+          dev-dependencies: true
+          peer-dependencies: true
+          optional-dependencies: true
 
       - name: Install Dependencies
         run: pnpm install

.gitea/workflows/security.yml

@@ -0,0 +1,177 @@
+name: Security Scan and Upload
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '0 0 * * 1'
+  workflow_dispatch:
+
+jobs:
+  security-audit:
+    name: Security & DefectDojo Upload
+    runs-on: ubuntu-latest
+    continue-on-error: true
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # --- AUTO-SETUP PROJECT ---
+      - name: Ensure DefectDojo Product Exists
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
+          PRODUCT_NAME: ${{ github.repository }} 
+          PRODUCT_TYPE_ID: 1 
+        run: |
+          sudo apt-get install jq -y > /dev/null
+          
+          echo "Checking connection to $DD_URL..."
+          
+          # Check if product exists - capture HTTP code to debug connection issues
+          RESPONSE=$(curl --write-out "%{http_code}" --silent --output /tmp/response.json \
+            -H "Authorization: Token $DD_TOKEN" \
+            "$DD_URL/api/v2/products/?name=$PRODUCT_NAME")
+          
+          # If response is not 200, print error
+          if [ "$RESPONSE" != "200" ]; then
+            echo "::error::Failed to query DefectDojo. HTTP Code: $RESPONSE"
+            cat /tmp/response.json
+            exit 1
+          fi
+
+          COUNT=$(cat /tmp/response.json | jq -r '.count')
+          
+          if [ "$COUNT" = "0" ]; then
+            echo "Creating product '$PRODUCT_NAME'..."
+            curl -s -X POST "$DD_URL/api/v2/products/" \
+              -H "Authorization: Token $DD_TOKEN" \
+              -H "Content-Type: application/json" \
+              -d '{ "name": "'"$PRODUCT_NAME"'", "description": "Auto-created by Gitea Actions", "prod_type": '$PRODUCT_TYPE_ID' }'
+          else
+            echo "Product '$PRODUCT_NAME' already exists."
+          fi
+
+      # --- 1. TRIVY (Dependencies & Misconfig) ---
+      - name: Install Trivy
+        run: |
+          sudo apt-get install wget apt-transport-https gnupg lsb-release -y
+          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
+          echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
+          sudo apt-get update && sudo apt-get install trivy -y
+
+      - name: Run Trivy (FS Scan)
+        run: |
+          trivy fs . --scanners vuln,misconfig --format json --output trivy-results.json --exit-code 0
+
+      - name: Upload Trivy to DefectDojo
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
+        run: |
+          echo "Uploading Trivy results..."
+          # Generate today's date in YYYY-MM-DD format
+          TODAY=$(date +%Y-%m-%d)
+          
+          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
+            -H "Authorization: Token $DD_TOKEN" \
+            -F "active=true" \
+            -F "verified=true" \
+            -F "scan_type=Trivy Scan" \
+            -F "engagement_name=CI/CD Pipeline" \
+            -F "product_name=${{ github.repository }}" \
+            -F "scan_date=$TODAY" \
+            -F "auto_create_context=true" \
+            -F "file=@trivy-results.json")
+          
+          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
+            echo "::error::Upload Failed with HTTP $HTTP_CODE"
+            echo "--- SERVER RESPONSE ---"
+            cat response.txt
+            echo "-----------------------"
+            exit 1
+          else
+            echo "Upload Success!"
+          fi
+
+      # --- 2. GITLEAKS (Secrets) ---
+      - name: Install Gitleaks
+        run: |
+          wget -qO gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.18.0/gitleaks_8.18.0_linux_x64.tar.gz
+          tar -xzf gitleaks.tar.gz
+          sudo mv gitleaks /usr/local/bin/ && chmod +x /usr/local/bin/gitleaks
+
+      - name: Run Gitleaks
+        run: gitleaks detect --source . -v --report-path gitleaks-results.json --report-format json --no-git || true
+
+      - name: Upload Gitleaks to DefectDojo
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
+        run: |
+          echo "Uploading Gitleaks results..."  
+          TODAY=$(date +%Y-%m-%d)
+
+          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
+            -H "Authorization: Token $DD_TOKEN" \
+            -F "active=true" \
+            -F "verified=true" \
+            -F "scan_type=Gitleaks Scan" \
+            -F "engagement_name=CI/CD Pipeline" \
+            -F "product_name=${{ github.repository }}" \
+            -F "scan_date=$TODAY" \
+            -F "auto_create_context=true" \
+            -F "file=@gitleaks-results.json")
+
+          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
+             echo "::error::Upload Failed with HTTP $HTTP_CODE"
+             echo "--- SERVER RESPONSE ---"
+             cat response.txt
+             echo "-----------------------"
+             exit 1
+          else
+             echo "Upload Success!"
+          fi
+
+      # --- 3. SEMGREP (SAST) ---
+      - name: Install Semgrep (via pipx)
+        run: |
+          sudo apt-get install pipx -y
+          pipx install semgrep
+          # Add pipx binary path to GITHUB_PATH so next steps can see 'semgrep'
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Run Semgrep
+        run: semgrep scan --config=p/security-audit --config=p/owasp-top-ten --json --output semgrep-results.json . || true
+
+      - name: Upload Semgrep to DefectDojo
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
+        run: |
+          echo "Uploading Semgrep results..."
+          TODAY=$(date +%Y-%m-%d)
+          
+          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
+            -H "Authorization: Token $DD_TOKEN" \
+            -F "active=true" \
+            -F "verified=true" \
+            -F "scan_type=Semgrep JSON Report" \
+            -F "engagement_name=CI/CD Pipeline" \
+            -F "product_name=${{ github.repository }}" \
+            -F "scan_date=$TODAY" \
+            -F "auto_create_context=true" \
+            -F "file=@semgrep-results.json")
+
+          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
+             echo "::error::Upload Failed with HTTP $HTTP_CODE"
+             echo "--- SERVER RESPONSE ---"
+             cat response.txt
+             echo "-----------------------"
+             exit 1
+          else
+             echo "Upload Success!"
+          fi

.gitea/workflows/sonar.yml

@@ -1,34 +0,0 @@
-name: Code Analysis
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  sonar:
-    name: SonarQube
-
-    steps:
-      - name: Checkout Source Files
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: SonarCube Scan
-        uses: SonarSource/sonarqube-scan-action@v4
-        timeout-minutes: 10
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-          SONAR_HOST_URL: "https://quality.nhcarrigan.com"
-        with:
-          args: >
-            -Dsonar.sources=.
-            -Dsonar.projectKey=website-headers
-
-      - name: SonarQube Quality Gate check
-        uses: sonarsource/sonarqube-quality-gate-action@v1
-        with:
-          pollingTimeoutSec: 600
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-          SONAR_HOST_URL: "https://quality.nhcarrigan.com"

.npmrc

@@ -0,0 +1,25 @@
+# Package Manager Configuration
+# Force pnpm usage - breaks npm/yarn intentionally
+node-linker=pnpm
+
+# Security: Disable all lifecycle scripts
+ignore-scripts=true
+enable-pre-post-scripts=false
+
+# Security: Require packages to be 10+ days old before installation
+minimum-release-age=14400
+
+# Security: Verify package integrity hashes
+verify-store-integrity=true
+
+# Security: Enforce strict trust policies
+trust-policy=strict
+
+# Security: Strict peer dependency resolution
+strict-peer-dependencies=true
+
+# Performance: Use symlinks for node_modules
+symlink=true
+
+# Lockfile: Ensure lockfile is not modified during install
+frozen-lockfile=false

README.md

@@ -12,7 +12,7 @@ This page is currently deployed. [View the live website.]
 
 ## Feedback and Bugs
 
-If you have feedback or a bug report, please feel free to open a GitHub issue!
+If you have feedback or a bug report, please [log a ticket on our forum](https://support.nhcarrigan.com).
 
 ## Contributing
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "website-headers",
-  "version": "3.1.0",
+  "version": "3.5.0",
   "description": "",
   "main": "index.js",
   "type": "module",

src/index.ts

@@ -40,6 +40,23 @@ const {
  * The title and description are set by each website. This should
  * only load things like open graph data and favicons.
  */
+const nhcarriganHeadersCharacterSet = document.createElement("meta");
+nhcarriganHeadersCharacterSet.setAttribute("charset", "UTF-8");
+const nhcarriganHeadersViewport = document.createElement("meta");
+nhcarriganHeadersViewport.setAttribute("name", "viewport");
+nhcarriganHeadersViewport.setAttribute(
+  "content",
+  "width=device-width, initial-scale=1.0",
+);
+const nhcarriganHeadersThemeColor = document.createElement("meta");
+nhcarriganHeadersThemeColor.setAttribute("name", "theme-color");
+nhcarriganHeadersThemeColor.setAttribute("content", "#E1F6F9");
+const nhcarriganHeadersReferrer = document.createElement("meta");
+nhcarriganHeadersReferrer.setAttribute("name", "referrer");
+nhcarriganHeadersReferrer.setAttribute(
+  "content",
+  "strict-origin-when-cross-origin",
+);
 const nhcarriganHeadersOpenGraphTitle = document.createElement("meta");
 nhcarriganHeadersOpenGraphTitle.setAttribute("property", "og:title");
 nhcarriganHeadersOpenGraphTitle.setAttribute(
@@ -68,6 +85,23 @@ nhcarriganHeadersOpenGraphUrl.setAttribute("content", nhcarriganHeadersUrl);
 const nhcarriganHeadersOpenGraphType = document.createElement("meta");
 nhcarriganHeadersOpenGraphType.setAttribute("property", "og:type");
 nhcarriganHeadersOpenGraphType.setAttribute("content", "website");
+const nhcarriganHeadersOpenGraphSiteName = document.createElement("meta");
+nhcarriganHeadersOpenGraphSiteName.setAttribute("property", "og:site_name");
+nhcarriganHeadersOpenGraphSiteName.setAttribute("content", "NHCarrigan");
+const nhcarriganHeadersOpenGraphLocale = document.createElement("meta");
+nhcarriganHeadersOpenGraphLocale.setAttribute("property", "og:locale");
+nhcarriganHeadersOpenGraphLocale.setAttribute("content", "en_US");
+const nhcarriganHeadersOpenGraphImageAlt = document.createElement("meta");
+nhcarriganHeadersOpenGraphImageAlt.setAttribute("property", "og:image:alt");
+nhcarriganHeadersOpenGraphImageAlt.
+  setAttribute("content", "NHCarrigan logo and branding");
+const nhcarriganHeadersOpenGraphImageWidth = document.createElement("meta");
+nhcarriganHeadersOpenGraphImageWidth.setAttribute("property", "og:image:width");
+nhcarriganHeadersOpenGraphImageWidth.setAttribute("content", "1920");
+const nhcarriganHeadersOpenGraphImageHeight = document.createElement("meta");
+nhcarriganHeadersOpenGraphImageHeight.
+  setAttribute("property", "og:image:height");
+nhcarriganHeadersOpenGraphImageHeight.setAttribute("content", "1080");
 
 const nhcarriganHeadersTwitterCard = document.createElement("meta");
 nhcarriganHeadersTwitterCard.setAttribute("name", "twitter:card");
@@ -100,6 +134,22 @@ nhcarriganHeadersTwitterImage.setAttribute(
   "content",
   "https://cdn.nhcarrigan.com/og-image.png",
 );
+const nhcarriganHeadersTwitterSite = document.createElement("meta");
+nhcarriganHeadersTwitterSite.setAttribute("name", "twitter:site");
+nhcarriganHeadersTwitterSite.setAttribute("content", "@nhcarrigan1");
+const nhcarriganHeadersTwitterCreator = document.createElement("meta");
+nhcarriganHeadersTwitterCreator.setAttribute("name", "twitter:creator");
+nhcarriganHeadersTwitterCreator.setAttribute("content", "@nhcarrigan1");
+
+const nhcarriganHeadersFormatDetection = document.createElement("meta");
+nhcarriganHeadersFormatDetection.setAttribute("name", "format-detection");
+nhcarriganHeadersFormatDetection.setAttribute("content", "telephone=no");
+const nhcarriganHeadersRobots = document.createElement("meta");
+nhcarriganHeadersRobots.setAttribute("name", "robots");
+nhcarriganHeadersRobots.setAttribute("content", "index, follow");
+const nhcarriganHeadersAuthor = document.createElement("meta");
+nhcarriganHeadersAuthor.setAttribute("name", "author");
+nhcarriganHeadersAuthor.setAttribute("content", "Naomi Carrigan");
 
 // #endregion
 
@@ -131,13 +181,14 @@ const nhcarriganHeadersStyles = document.createElement("style");
 nhcarriganHeadersStyles.id = "nhcarrigan-global-styles";
 nhcarriganHeadersStyles.innerHTML = `
 @font-face {
-  font-family: 'OpenDyslexic';
+  font-family: 'Vampyr';
-  src: url('https://cdn.nhcarrigan.com/fonts/OpenDyslexicMono-Regular.otf') format('opentype');
+  src: url('https://cdn.nhcarrigan.com/fonts/vampyr.ttf') format('truetype');
 }
 
 :root {
   --foreground: #8F2447;
   --background: #E1F6F9DC;
+  font-size: 12pt;
 }
 
 * {
@@ -147,7 +198,7 @@ nhcarriganHeadersStyles.innerHTML = `
 }
 
 html {
-  font-family: 'OpenDyslexic', monospace;
+  font-family: 'Vampyr', monospace;
   cursor: url('https://cdn.nhcarrigan.com/cursors/cursor.cur'), auto;
   min-height: 100vh;
   min-width: 100vw;
@@ -206,7 +257,7 @@ footer {
   cursor: url('https://cdn.nhcarrigan.com/cursors/pointer.cur'), pointer;
   color: var(--foreground);
   font-size: 1rem;
-  font-family: 'OpenDyslexic', monospace;
+  font-family: 'Vampyr', monospace;
 }
 #show-socials-button > i, #theme-select-button > i {
   font-size: 1.5rem;
@@ -266,6 +317,18 @@ a {
     margin-bottom: 60px;
   }
 }
+
+@media screen and (max-width: 425px) {
+  #donate-badge {
+    display: none;
+  }
+}
+
+@media screen and (max-width: 350px) {
+  footer, #show-socials-button, #theme-select-button, #show-socials-button > i, #theme-select-button > i {
+    font-size: 10pt;
+  }
+}
 `;
 
 // #endregion
@@ -275,14 +338,14 @@ a {
 const nhcarriganHeadersFooter = document.createElement("footer");
 nhcarriganHeadersFooter.innerHTML = `
 <div id="footer-inner-container">
-<p>&copy; <a href="https://nhcarrigan.com" target="_blank">Naomi Carrigan</a></p>
+<p id="footer-copyright">&copy; <a href="https://nhcarrigan.com" target="_blank">Naomi Carrigan</a></p>
 <button id="show-socials-button" type="button">
   <i class="fa-solid fa-share-nodes"></i> Connect with Us
 </button>
 <button id="theme-select-button" type="button">
   <i id="theme-select-icon" class="fa-solid fa-moon"></i> Toggle Theme
 </button>
-<a href="https://buy.stripe.com/cN24iTfqu1j6b3afZ2" target="_blank" rel="noreferrer">
+<a id="donate-badge" href="https://buy.stripe.com/cN24iTfqu1j6b3afZ2" target="_blank" rel="noreferrer">
   <img src="https://cdn.nhcarrigan.com/donate.png" alt="Donate" style="width: 70px; height: 70px;">
 </a>
 <div id="tree-nation-offset-website"></div>
@@ -370,29 +433,19 @@ const nhcarriganHeadersFontAwesome = document.createElement("script");
 nhcarriganHeadersFontAwesome.src = "https://kit.fontawesome.com/f949111719.js";
 const nhcarriganHeadersAnalytics = document.createElement("script");
 nhcarriganHeadersAnalytics.defer = true;
-nhcarriganHeadersAnalytics.setAttribute("domain", "nhcarrigan.com");
 nhcarriganHeadersAnalytics.src
-  // eslint-disable-next-line stylistic/max-len
+
-  = "https://analytics.nhcarrigan.com/js/script.file-downloads.hash.outbound-links.pageview-props.revenue.tagged-events.js";
+  = "https://analytics.nhcarrigan.com/js/pa-YUXAn1vhhRttySUAw_LMN.js";
-nhcarriganHeadersAnalytics.setAttribute(
-  "event-domain",
-  nhcarriganHeadersHostname,
-);
-nhcarriganHeadersAnalytics.setAttribute("data-domain", "nhcarrigan.com");
-nhcarriganHeadersAnalytics.setAttribute(
-  "event-page",
-  nhcarriganHeadersTitle?.innerText ?? "Unknown Page",
-);
-nhcarriganHeadersAnalytics.setAttribute(
-  "event-path",
-  nhcarriganHeadersPathname,
-);
 const nhcarriganHeadersAnalytics2 = document.createElement("script");
 nhcarriganHeadersAnalytics2.innerHTML = `
-window.plausible = window.plausible ??
+  window.plausible=window.plausible||function(){(plausible.q=plausible.q||[]).push(arguments)},plausible.init=plausible.init||function(i){plausible.o=i||{}};
-function() { 
+  plausible.init({
-  (window.plausible.q = window.plausible.q ?? []).push(arguments) 
+    customProperties: {
-}
+      domain: "${nhcarriganHeadersHostname}",
+      page: "${nhcarriganHeadersTitle?.innerText ?? "Unknown Page"}",
+      path: "${nhcarriganHeadersPathname}",
+    },
+  })
 `;
 const nhcarriganHeadersGoogleAdsense = document.createElement("script");
 nhcarriganHeadersGoogleAdsense.async = true;
@@ -405,23 +458,35 @@ nhcarriganHeadersGoogleAdsense.setAttribute("crossorigin", "anonymous");
 
 // #region Inject Elements
 
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersCharacterSet);
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersViewport);
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersThemeColor);
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersReferrer);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersOpenGraphTitle);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersOpenGraphDescription);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersOpenGraphImage);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersOpenGraphUrl);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersOpenGraphType);
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersOpenGraphSiteName);
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersOpenGraphLocale);
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersOpenGraphImageAlt);
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersOpenGraphImageWidth);
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersOpenGraphImageHeight);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersTwitterCard);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersTwitterDomain);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersTwitterUrl);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersTwitterTitle);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersTwitterDescription);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersTwitterImage);
-
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersTwitterSite);
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersTwitterCreator);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersFavicon);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersAppleTouchIcon);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersSmallIcon);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersLargeIcon);
-
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersFormatDetection);
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersRobots);
+nhcarriganHeadersHead?.appendChild(nhcarriganHeadersAuthor);
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersStyles);
 
 nhcarriganHeadersHead?.appendChild(nhcarriganHeadersTreeNation);
@@ -592,4 +657,10 @@ const nhcarriganHeadersShowModal = (): void => {
 
 nhcarriganHeadersBody?.appendChild(nhcarriganHeadersCta);
 nhcarriganHeadersBody?.appendChild(nhcarriganHeadersModalBg);
+
+const nhcarriganNoModalUrls = [
+  "https://forms.nhcarrigan.com/o/docs/forms/7LNb8jFoN4SPBvP7vRxDi2/4",
+];
+if (!nhcarriganNoModalUrls.includes(nhcarriganHeadersUrl)) {
   nhcarriganHeadersShowModal();
+}