fix(security): remediate SonarQube vulnerabilities

[devin-ai-integration]

Summary

Remediates 6 security issues identified through manual code analysis based on SonarQube rule patterns. Changes span 6 source files across auth, article, config, and HTML layers. A detailed HTML vulnerability report (vulnerability-report.html) is included at the repo root with before/after comparisons.

Fixes by severity:

Severity	Count	Files
Critical	1	src/index.html — protocol-relative URLs → explicit https:// (S5332 / CWE-319)
Major	3	jwt.service.ts — bracket notation → .getItem()/.setItem() with constant key (S6319); articles.service.ts — removed @ts-ignore, replaced with Object.entries() + null guard (S1862); app.config.ts — guard debug interface behind ngDevMode (S2068/S4507)
Minor	2	auth.component.html — email type="text" → type="email", added autocomplete attrs (S5122); settings.component.html — added autocomplete="new-password" (S5122)

Review & Testing Checklist for Human

• app.config.ts — ngDevMode guard may break E2E tests. The window.__conduit_debug__ interface is used by Playwright E2E tests for state inspection. With this change it is only exposed when ngDevMode is truthy. Verify that E2E tests still pass (they run against a dev server where ngDevMode should be set, but confirm this assumption).
• jwt.service.ts — return type changed from undefined to ''. getItem() returns null when key is absent; ?? '' coerces to empty string. The old bracket-notation code returned undefined. Audit all callers of getToken() (e.g., the API interceptor, debug interface, auth guards) to confirm they rely on truthiness checks rather than === undefined.
• articles.service.ts — null/undefined filter values now skipped. Previously all filter keys were sent as query params even if the value was undefined/null. Now they are omitted. Confirm this doesn't change API behavior (it likely improves it, but verify the backend tolerates missing optional params).
• vulnerability-report.html at repo root — decide whether this 800+ line report file belongs in the repository long-term or should be moved to a docs folder / excluded from the repo.
• Run bun run test:e2e (Playwright) end-to-end to validate login, feed browsing, and settings flows still work after the auth form and debug interface changes.

Notes

• No actual SonarQube scan was executed — the project is not configured in SonarCloud (cog-gtm org). Vulnerabilities were identified via manual code review against the SonarSource rules catalog and CWE database. CVSS scores in the report are estimated, not from a scanner.
• Unit tests (bun run test) could not be verified locally due to a pre-existing zone.js resolution error unrelated to these changes. CI should be the source of truth for test results.

Link to Devin session: https://app.devin.ai/sessions/8772eec7f9ac400897fa7cae7d669753
Requested by: @SachetCognition

[devin-ai-integration]

Prompt hidden (unlisted session)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring