From 0df7434be42654b5c1826b1d9f3925a64939f3b4 Mon Sep 17 00:00:00 2001
From: posimai <posimai.project@gmail.com>
Date: Fri, 17 Apr 2026 18:43:59 +0900
Subject: [PATCH] fix(security): add noreferrer to all target=_blank links, add
 manifest id

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 index.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/index.html b/index.html
index 661d035..f0303b6 100644
--- a/index.html
+++ b/index.html
@@ -715,7 +715,7 @@
                 </button>
                 <div class="header-dot" aria-hidden="true"></div>
                 <span class="header-title" id="headerTitle">Board</span>
-                <a id="headerAppLink" href="#" target="_blank" rel="noopener" style="display:none;font-size:11px;color:var(--text3);text-decoration:none;margin-left:6px;" onmouseover="this.style.color='var(--accent)'" onmouseout="this.style.color='var(--text3)'"></a>
+                <a id="headerAppLink" href="#" target="_blank" rel="noopener noreferrer" style="display:none;font-size:11px;color:var(--text3);text-decoration:none;margin-left:6px;" onmouseover="this.style.color='var(--accent)'" onmouseout="this.style.color='var(--text3)'"></a>
             </div>
             <button class="icon-btn" id="addHeaderBtn" aria-label="タスクを追加">
                 <i data-lucide="plus" style="width:18px;height:18px;stroke-width:2"></i>
@@ -1073,7 +1073,7 @@ function boardCard(t, showApp = true) {
     const note = (t.status === 'hold' && t.note)
         ? `<div class="task-hold-note">${esc(t.note)}</div>` : '';
     const commit = t.commit
-        ? `<a class="task-commit" href="https://github.com/posimai/${t.appId}/commit/${t.commit}" target="_blank" rel="noopener">${t.commit.slice(0,7)}</a>` : '';
+        ? `<a class="task-commit" href="https://github.com/posimai/${t.appId}/commit/${t.commit}" target="_blank" rel="noopener noreferrer">${t.commit.slice(0,7)}</a>` : '';
     const date = (done && t.done_at) ? `<span class="task-date">${t.done_at}</span>` : '';
     const appChip = showApp ? `<div class="task-app-chip">${shortName(t.appId)}</div>` : '';
     return `<div class="task-card${done?' task-done':''}" data-id="${t.id}" data-app="${t.appId}" draggable="true" role="button" tabindex="0">