From 16854e8b24a3b00d9d5dbd285bbe3b93ee47ce1c Mon Sep 17 00:00:00 2001
From: Gab Virebent <gabriel1@virebent.art>
Date: Mon, 6 Jul 2026 16:34:47 +0200
Subject: Guard key material in RAM with memguard, add Markdown preview for
 message field

Reader now keeps the private key bytes and the per-submission ECDH/HKDF
secrets in memguard.LockedBuffer (mlock + guaranteed wipe) instead of a
manual zero loop. Added a regression test for the decrypt path.

Message field gets a self-hosted Markdown toggle preview (no external
library): headers, bold/italic, inline code, code blocks, blockquotes,
lists, links. Output is HTML-escaped and link schemes are whitelisted
before rendering. Submitted content is still the raw Markdown source,
unchanged on the wire.
---
 static/index.html | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

(limited to 'static/index.html')

diff --git a/static/index.html b/static/index.html
index 33e5868..abf2e8c 100644
--- a/static/index.html
+++ b/static/index.html
@@ -27,8 +27,12 @@
     </div>
 
     <form id="drop-form">
-        <label for="message">Message</label>
-        <textarea id="message" placeholder="Write your message here. It will be encrypted before leaving your browser."></textarea>
+        <div class="message-header">
+            <label for="message">Message</label>
+            <button type="button" id="preview-toggle" class="preview-toggle">Preview</button>
+        </div>
+        <textarea id="message" placeholder="Write your message here (Markdown supported). It will be encrypted before leaving your browser."></textarea>
+        <div id="message-preview" class="md-preview" hidden></div>
 
         <div class="file-section">
             <label>Attachment (optional)</label>
@@ -54,6 +58,7 @@
 </div>
 <div class="footer">NYMDROP &nbsp;·&nbsp; ZERO KNOWLEDGE &nbsp;·&nbsp; ZERO LOGS</div>
 <script src="/crypto.js"></script>
+<script src="/markdown.js"></script>
 <script src="/app.js"></script>
 </body>
 </html>
-- 
cgit v1.2.3