fix: the application fetches apps in app.js

[anupamme]

Summary

Fix high severity security issue in app.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	app.js:68
Assessment	Likely exploitable

Description: The application fetches apps.json from an external source and renders its content directly into the DOM using innerHTML and template literals without sanitization. Multiple fields from the JSON (app.name, app.subtitle, app.icon, app.iconEmoji, app.description, app.features, etc.) are interpolated into HTML templates and rendered via innerHTML. If an attacker can compromise the apps.json data source (via MITM on the GitHub API in update-stats.sh, or by compromising the repository), they can inject malicious JavaScript that executes in all users' browsers.

Evidence

Exploitation scenario: An attacker who can perform MITM on the GitHub API responses or compromise the update-stats.sh execution environment can inject XSS payloads into apps.json fields.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Changes

• app.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

Automated security fix by OrbisAI Security