diff --git a/posimai-sc/index.html b/posimai-sc/index.html
index 78737ad3..a40479e2 100644
--- a/posimai-sc/index.html
+++ b/posimai-sc/index.html
@@ -2,6 +2,19 @@
 <html lang="ja" data-app-id="posimai-sc">
 <head>
 <meta charset="UTF-8">
+<meta http-equiv="Content-Security-Policy" content="
+  default-src 'self';
+  script-src 'self' https://cdn.jsdelivr.net https://unpkg.com 'unsafe-inline' 'unsafe-eval';
+  style-src 'self' https://fonts.googleapis.com 'unsafe-inline';
+  font-src https://fonts.gstatic.com;
+  connect-src 'self' https://api.soar-enrich.com;
+  img-src 'self' data:;
+  worker-src 'self';
+  manifest-src 'self';
+  frame-ancestors 'none';
+  base-uri 'self';
+  form-action 'self'
+">
 <meta name="robots" content="noindex, nofollow">
 <script>
 (function(){
@@ -421,6 +434,8 @@ header{display:flex;align-items:center;justify-content:space-between;padding:0 1
           <template x-for="u in cat.units" :key="u.id">
             <div class="sidebar-item"
               role="button" tabindex="0"
+              :aria-label="u.num + ': ' + u.title"
+              :aria-pressed="!!(currentUnit && currentUnit.id===u.id)"
               :class="{active: currentUnit && currentUnit.id===u.id, done: isDone(u.id)}"
               @click="openUnit(u); sidebarOpen=false"
               @keydown.enter.prevent="openUnit(u); sidebarOpen=false"
@@ -436,7 +451,7 @@ header{display:flex;align-items:center;justify-content:space-between;padding:0 1
       </template>
     </nav>
 
-    <main id="main">
+    <main id="main" tabindex="-1">
       <!-- HOME -->
       <div x-show="!currentUnit && !weakDrillActive && !glossaryViewActive && !examActive">
         <div class="home-hero">
@@ -549,7 +564,7 @@ header{display:flex;align-items:center;justify-content:space-between;padding:0 1
           </div>
           <div class="glossary-meta-line" x-text="filteredGlossary.length + ' 件 / 全 ' + glossaryRows.length + ' 件'"></div>
           <div class="glossary-list">
-            <template x-for="(row, gi) in filteredGlossary" :key="'g'+gi+'-'+row.unitId+'-'+row.term">
+            <template x-for="row in filteredGlossary" :key="row.unitId+'-'+row.term">
               <div class="glossary-row" role="button" tabindex="0"
                 @click="openUnitFromGlossary(row.unitId)"
                 @keydown.enter.prevent="openUnitFromGlossary(row.unitId)"
diff --git a/posimai-sc/js/app.js b/posimai-sc/js/app.js
index 10f2424b..10c8d760 100644
--- a/posimai-sc/js/app.js
+++ b/posimai-sc/js/app.js
@@ -82,7 +82,8 @@ function sanitizeTrustedHtml(dirty) {
     return d.innerHTML;
   }
   return window.DOMPurify.sanitize(s, {
-    USE_PROFILES: { html: true, svg: true, svgFilters: true },
+    ALLOWED_TAGS: ['p', 'div', 'span', 'strong', 'em', 'br', 'ul', 'ol', 'li', 'code', 'pre'],
+    ALLOWED_ATTR: ['class'],
     ALLOW_UNKNOWN_PROTOCOLS: false
   });
 }
@@ -154,7 +155,8 @@ document.addEventListener('alpine:init', () => {
       catch{ this.wrongUnits = {}; }
       this.syncStateAt = parseInt(localStorage.getItem('posimai-sc-state-at') || '0', 10) || 0;
       const jwtToken = (localStorage.getItem('posimai_token') || '').trim();
-      const apiKey = (localStorage.getItem(SYNC_KEY_LS) || '').trim();
+      // posimai_api_key: sessionStorage 優先、旧 localStorage からの移行フォールバック
+      const apiKey = (sessionStorage.getItem(SYNC_KEY_LS) || localStorage.getItem(SYNC_KEY_LS) || '').trim();
       this.syncToken = jwtToken || apiKey;
       this.syncEnabled = !!this.syncToken;
       const t = localStorage.getItem('posimai-sc-theme')||'system';
@@ -171,12 +173,12 @@ document.addEventListener('alpine:init', () => {
         this.$nextTick(()=>{ if(window.lucide) lucide.createIcons(); });
       });
       if(this.syncEnabled){
-        this.pullCloudState().catch(()=>{});
+        this.pullCloudState().catch(e=>{ console.warn('[sc] pullCloudState failed:', e); });
       } else {
         this.syncStatus = '同期キー未設定';
       }
       if('serviceWorker' in navigator){
-        navigator.serviceWorker.register('/sw.js').catch(()=>{});
+        navigator.serviceWorker.register('/sw.js').catch(e=>{ console.warn('[sc] SW register failed:', e); });
       }
       document.addEventListener('keydown',(e)=>{
         const t=e.target;
@@ -238,7 +240,7 @@ document.addEventListener('alpine:init', () => {
       if(this.syncEnabled) this.scheduleCloudPush();
     },
     get syncHeader(){
-      const token = (localStorage.getItem('posimai_token') || '').trim() || (this.syncToken || '').trim();
+      const token = (this.syncToken || '').trim();
       return token ? { Authorization: 'Bearer ' + token } : null;
     },
     async pullCloudState(){
@@ -303,7 +305,7 @@ document.addEventListener('alpine:init', () => {
     },
     scheduleCloudPush(){
       if(this.syncTimer) clearTimeout(this.syncTimer);
-      this.syncTimer = setTimeout(()=>{ this.pushCloudState().catch(()=>{}); }, 800);
+      this.syncTimer = setTimeout(()=>{ this.pushCloudState().catch(e=>{ console.warn('[sc] pushCloudState failed:', e); }); }, 800);
     },
     enableSyncWithInput(){
       const token = (this.syncToken || '').trim();
@@ -311,9 +313,9 @@ document.addEventListener('alpine:init', () => {
         this.syncStatus = '同期キー未設定';
         return;
       }
-      localStorage.setItem(SYNC_KEY_LS, token);
+      sessionStorage.setItem(SYNC_KEY_LS, token);
       this.syncEnabled = true;
-      this.pullCloudState().catch(()=>{});
+      this.pullCloudState().catch(e=>{ console.warn('[sc] pullCloudState failed:', e); });
     },
     async syncNow(){
       if(!this.syncEnabled){
@@ -393,7 +395,7 @@ document.addEventListener('alpine:init', () => {
     isDone(id){ return !!this.progress[id]; },
     markDone(){
       if(!this.currentUnit) return;
-      this.progress[this.currentUnit.id]=true;
+      this.progress = {...this.progress, [this.currentUnit.id]: true};
       localStorage.setItem('posimai-sc-progress',JSON.stringify(this.progress));
       this.markStateChanged();
     },
@@ -412,7 +414,7 @@ document.addEventListener('alpine:init', () => {
     saveScore(id,correct,total){
       const prev=this.scores[id];
       if(!prev||correct>prev.best){
-        this.scores[id]={best:correct,total};
+        this.scores = {...this.scores, [id]: {best:correct, total}};
         localStorage.setItem('posimai-sc-scores',JSON.stringify(this.scores));
         this.markStateChanged();
       }
@@ -446,7 +448,7 @@ document.addEventListener('alpine:init', () => {
       this.$nextTick(()=>{
         if(window.lucide) lucide.createIcons();
         const m=document.getElementById('main');
-        if(m) m.scrollTo({top:0,behavior:'smooth'});
+        if(m){ m.scrollTo({top:0,behavior:'smooth'}); m.focus({preventScroll:true}); }
       });
     },
 
@@ -462,7 +464,7 @@ document.addEventListener('alpine:init', () => {
         delete this.wrongUnits[uid];
         // auto-mark done on perfect score
         if(!this.progress[uid]){
-          this.progress[uid]=true;
+          this.progress = {...this.progress, [uid]: true};
           try{ localStorage.setItem('posimai-sc-progress',JSON.stringify(this.progress)); }catch(e){}
           this.markStateChanged();
         }
diff --git a/posimai-sc/sw.js b/posimai-sc/sw.js
index 81448af4..bd461a77 100644
--- a/posimai-sc/sw.js
+++ b/posimai-sc/sw.js
@@ -1,5 +1,5 @@
 // posimai-sc SW — same-origin の静的資産のみキャッシュ（CDN は対象外）
-const CACHE = 'posimai-sc-v7';
+const CACHE = 'posimai-sc-v8';
 const STATIC = [
   '/',
   '/index.html',
@@ -48,7 +48,12 @@ self.addEventListener('fetch', e => {
       cache.match(e.request).then(cached => {
         const network = fetch(e.request)
           .then(res => {
-            if (res.ok && res.type === 'basic') cache.put(e.request, res.clone());
+            // type:'basic' = same-origin only; CORS レスポンスはキャッシュしない
+            if (res.ok && res.type === 'basic') {
+              cache.put(e.request, res.clone()).catch(err => {
+                console.warn('[sc-sw] cache.put failed (quota?):', err);
+              });
+            }
             return res;
           })
           .catch(() => cached || new Response('Offline', { status: 503, statusText: 'Service Unavailable' }));
