Fix XSS in side panel via unescaped server data (#245)#256

Open

boot-coco wants to merge 2 commits intodevelopfrom

fix/245-sidepanel-xss

Commits on Mar 9, 2026

fix: escape server data in side panel innerHTML to prevent XSS (#245)

boot-coco
and
claude
committed
fix: add app_id scope check to V1 API handlers (#244)

boot-coco
and
claude
committed