Version 0.48.1

Turned on a browser rule that stops text from becoming code, and it now blocks rather than watches.

Every page already told your browser where scripts may come from, which does not cover the other way code gets in: a string handed to a DOM property that turns it into code. The rule that closes that door has been going out since 2026-08-16, but only as a measurement — the browser reported what would have been blocked and blocked nothing — and it now blocks. Three things had to be solved first: the human check re-loads its own script that way, so a gatekeeper runs before anything else on the page and lets through only this origin and Cloudflare's two; a refusal returns empty rather than throwing, because a browser stays silent about a policy that throws, which is why the first measurement read zero and was wrong; and the wallet library was writing theme variables into a style element as text, which only that library's own screens use, so it is switched off. Pages still allow inline scripts, browsers that do not know the rule ignore it, and the allow-list is per origin — it trusts those hosts, it does not inspect what they send.