Harden CSP, add GitHub meta files, fix a11y/SEO gaps, optimize cover image

CSP: add object-src none, base-uri none, upgrade-insecure-requests.
SEO: shorten title/meta description to fit SERP limits on all 4 languages;
add cover-small.jpg/webp (624x630->624x328) for inline About block instead
of reusing the 1200x630 og:image, cutting ~12-16KB per page load.
A11y: role=radiogroup/aria-checked on quiz options, replace innerHTML with
textContent for cta-footer, replace alert() with an accessible toast,
respect prefers-reduced-motion, add a print stylesheet.
GitHub hygiene: CODEOWNERS, Dependabot, CodeQL workflow.
Docs: SECURITY.md contact + platform limitations, manifest.json categories,
ai.txt, 404.html SEO tags, privacy/terms OG tags + hreflang.
Cleanup: remove dead [data-lang] CSS rules now that LangFilter strips
non-matching languages at build time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: IamAlex-afk

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default owner for everything in the repo, unless overridden below.
+*       sintyau1777@gmail.com

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/codeql.yml

@@ -0,0 +1,31 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 6 * * 1'  # weekly, Monday 06:00 UTC
+
+jobs:
+  analyze:
+    name: Analyze JavaScript
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:javascript"

.well-known/security.txt

@@ -1,4 +1,5 @@
 Contact: https://t.me/ASTROSCAN_BOT
+Contact: mailto:sintyau1777@gmail.com
 Expires: 2027-06-22T00:00:00.000Z
 Preferred-Languages: en, ru, es, hi
 Canonical: https://astroscan-lab.github.io/astroscan_bot/.well-known/security.txt

404.html

@@ -5,6 +5,12 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <meta name="robots" content="noindex">
   <title>404 · Page Not Found — AstroScan</title>
+  <meta name="description" content="The page you're looking for doesn't exist. Take the free AstroScan personality test or return to the homepage.">
+  <meta property="og:title" content="404 · Page Not Found — AstroScan">
+  <meta property="og:description" content="The page you're looking for doesn't exist. Take the free AstroScan personality test or return to the homepage.">
+  <meta property="og:image" content="https://astroscan-lab.github.io/astroscan_bot/cover.jpg">
+  <meta property="og:url" content="https://astroscan-lab.github.io/astroscan_bot/404.html">
+  <meta property="og:type" content="website">
   <link rel="icon" type="image/x-icon" href="/astroscan_bot/favicon.ico">
   <style>
     * { margin: 0; padding: 0; box-sizing: border-box; }

SECURITY.md

@@ -7,12 +7,22 @@ AstroScan is a static, client-side personality test (no backend, no account syst
 If you find a security issue (XSS, CSP bypass, dependency confusion, etc.), please report it privately via:
 
 - **Telegram:** [@ASTROSCAN_BOT](https://t.me/ASTROSCAN_BOT)
+- **Email:** sintyau1777@gmail.com
 
 Please do not open a public GitHub issue for security reports. We aim to acknowledge reports within 7 days.
 
 ## Scope
 
-- `index.html`, `ru/`, `es/`, `hi/` — the static frontend
-- `app.js`-style inline scripts and the Content-Security-Policy configuration
+- `template.html`, `privacy_template.html`, `terms_template.html` and the pages `build.py`/`build_zodiac.py` generate from them (`index.html`, `ru/`, `es/`, `hi/`, zodiac sign pages, `privacy.html`, `terms.html`)
+- `assets/js/main.js` and the Content-Security-Policy configuration
 
 Out of scope: the Telegram bot backend and its natal-chart calculation pipeline, which are not part of this repository.
+
+## Known Platform Limitations
+
+This site is hosted on GitHub Pages' free tier, which does not allow setting custom HTTP response headers. As a result:
+
+- **`X-Frame-Options`** cannot be set at the HTTP level. Clickjacking protection is instead enforced via the `frame-ancestors` directive in the CSP `<meta>` tag, which all modern browsers honor (note: `frame-ancestors` has no effect when delivered via `<meta>` per spec in some older browsers — this is a known tradeoff of static hosting without server-side header control).
+- **HSTS** cannot be set at all — it is an HTTP-header-only mechanism and has no `<meta>` equivalent. GitHub Pages itself serves over HTTPS with redirect, which provides baseline protection, but we cannot enforce HSTS preloading from this repository.
+
+If these matter for your use case, hosting behind a CDN/reverse proxy that adds these headers (e.g. Cloudflare) would be required — that's a deployment change outside this repository's scope.

ai.txt

@@ -0,0 +1,5 @@
+# ai.txt — experimental, not yet a ratified standard (unlike robots.txt).
+# Included as a forward-looking complement to llms.txt; AI crawlers/assistants
+# should treat llms.txt as the authoritative structured summary of this site.
+LLM: https://astroscan-lab.github.io/astroscan_bot/llms.txt
+Allow: /

assets/css/styles.css

@@ -84,11 +84,6 @@
     .cta-bar a { flex: 1; text-align: center; padding: 14px; text-decoration: none; font-weight: bold; text-transform: uppercase; color: var(--text-light); }
     .cta-bar .telegram-cta { background: var(--accent-primary); color: #0a0718; }
     .lazy-section { min-height: 300px; contain: layout; }
-    [data-lang] { display: none; }
-    body.lang-en [data-lang="en"] { display: revert; }
-    body.lang-ru [data-lang="ru"] { display: revert; }
-    body.lang-es [data-lang="es"] { display: revert; }
-    body.lang-hi [data-lang="hi"] { display: revert; }
     *:focus-visible { outline: 2px solid var(--accent-primary); outline-offset: 2px; }
     @media (max-width: 700px) { body { padding: 1rem; } .static-hero h1 { font-size: 1.8rem; } .card { padding: 1rem; }.static-hero { min-height: 500px; } }
     .hidden { display: none; }
@@ -114,3 +109,33 @@
 
 .service-card-link { text-decoration: none; border: 1px solid var(--border-dim); border-radius: 1rem; padding: 1rem; display: block; color: inherit; transition: border-color 0.2s; }
 .service-card-link:hover { border-color: var(--accent-primary); }
+
+@media (prefers-reduced-motion: reduce) {
+  *, *::before, *::after {
+    animation-duration: 0.01ms !important;
+    animation-iteration-count: 1 !important;
+    transition-duration: 0.01ms !important;
+  }
+  .telegram-cta { animation: none !important; }
+  .fade-up { opacity: 1 !important; transform: none !important; }
+}
+
+@media print {
+  body { background: white !important; color: black !important; padding: 0 !important; }
+  .cta-bar, .lang-bar, .telegram-link, .telegram-cta, .skip-link { display: none !important; }
+  .card { border: 1px solid #ccc !important; box-shadow: none !important; break-inside: avoid; }
+  .static-hero h1 { color: black !important; background: none !important; -webkit-background-clip: initial !important; background-clip: initial !important; }
+  a { color: #000 !important; text-decoration: underline !important; }
+}
+
+.toast-container {
+  position: fixed; bottom: 80px; left: 50%; transform: translateX(-50%);
+  z-index: 1000; pointer-events: none;
+}
+.toast {
+  background: var(--card-bg); color: var(--text-light); padding: 0.75rem 1.5rem;
+  border-radius: 1.5rem; border: 1px solid var(--accent-primary); margin-top: 0.5rem;
+  opacity: 0; transform: translateY(20px); transition: opacity 0.3s ease, transform 0.3s ease;
+  pointer-events: auto; max-width: 90vw; text-align: center;
+}
+.toast.visible { opacity: 1; transform: translateY(0); }

assets/js/main.js

@@ -97,6 +97,28 @@
     const LANGS = ['en','ru','hi','es'];
     const LANG_NAMES = { en:'English', ru:'Русский', hi:'हिन्दी', es:'Español' };
     let currentLang = 'en';
+    function showToast(message, duration) {
+      duration = duration || 3000;
+      let container = document.querySelector('.toast-container');
+      if (!container) {
+        container = document.createElement('div');
+        container.className = 'toast-container';
+        container.setAttribute('role', 'region');
+        container.setAttribute('aria-label', 'Notifications');
+        document.body.appendChild(container);
+      }
+      const toast = document.createElement('div');
+      toast.className = 'toast';
+      toast.setAttribute('role', 'alert');
+      toast.setAttribute('aria-live', 'polite');
+      toast.textContent = message;
+      container.appendChild(toast);
+      requestAnimationFrame(() => requestAnimationFrame(() => toast.classList.add('visible')));
+      setTimeout(() => {
+        toast.classList.remove('visible');
+        setTimeout(() => toast.remove(), 300);
+      }, duration);
+    }
     const translations = {
       en: {
         ctaFooter: '⚡ GET FULL REPORT IN TELEGRAM',
@@ -332,7 +354,7 @@
       document.querySelectorAll('.lang-btn').forEach(b => b.classList.remove('active'));
       document.getElementById(`lang-${lang}`)?.classList.add('active');
       const t = translations[lang];
-      document.getElementById('cta-footer').innerHTML = t.ctaFooter;
+      document.getElementById('cta-footer').textContent = t.ctaFooter;
       if (!window.currentQuizState) renderApp();
       else if (window.currentQuizState === 'quiz') renderApp();
       else if (window.currentQuizState === 'result') renderResult();
@@ -442,18 +464,19 @@
           const t = translations[currentLang];
           const questionText = q[`text${currentLang.charAt(0).toUpperCase()+currentLang.slice(1)}`] || q.textEn;
           const options = q[`options${currentLang.charAt(0).toUpperCase()+currentLang.slice(1)}`] || q.optionsEn;
-          const optsHtml = options.map((opt, idx) => `<button class="option-btn" data-opt="${idx}" type="button">${opt}</button>`).join('');
+          const optsHtml = options.map((opt, idx) => `<button class="option-btn" data-opt="${idx}" type="button" role="radio" aria-checked="false">${opt}</button>`).join('');
           app.innerHTML = `
             <div class="card">
               <div class="progress-bar"><div class="progress-fill" style="width:${(currentQuestion/QUESTIONS.length)*100}%"></div></div>
-              <div class="question-text">${questionText}</div>
-              <div class="options">${optsHtml}</div>
+              <div class="question-text" id="questionLabel">${questionText}</div>
+              <div class="options" role="radiogroup" aria-labelledby="questionLabel">${optsHtml}</div>
               <button class="btn-primary" id="nextBtn">${currentQuestion === QUESTIONS.length-1 ? t.result : t.next}</button>
             </div>`;
           document.querySelectorAll('.option-btn').forEach(btn => {
             btn.addEventListener('click', () => {
-              document.querySelectorAll('.option-btn').forEach(b => b.classList.remove('selected'));
+              document.querySelectorAll('.option-btn').forEach(b => { b.classList.remove('selected'); b.setAttribute('aria-checked', 'false'); });
               btn.classList.add('selected');
+              btn.setAttribute('aria-checked', 'true');
               answers[currentQuestion] = parseInt(btn.dataset.opt);
             });
           });
@@ -568,7 +591,7 @@
           setTimeout(() => URL.revokeObjectURL(url), 1000);
         } catch (e) {
           if (navigator.share) { navigator.share({ title: 'AstroScan Result', url: window.location.href }); }
-          else { alert(t.copyLink); }
+          else { showToast(t.copyLink); }
         }
       });
       function getTrackerData() {

build.ps1

@@ -0,0 +1,23 @@
+# Local build script for AstroScan static site.
+# Mirrors .github/workflows/build.yml: regenerate all pages from the templates,
+# regenerate the sitemap, then validate everything before you commit.
+#
+# Usage: .\build.ps1
+
+$ErrorActionPreference = "Stop"
+
+function Run-Step($Name, $Command) {
+    Write-Host "==> $Name" -ForegroundColor Cyan
+    & python @Command
+    if ($LASTEXITCODE -ne 0) {
+        Write-Host "FAILED: $Name (exit code $LASTEXITCODE)" -ForegroundColor Red
+        exit $LASTEXITCODE
+    }
+}
+
+Run-Step "Generate index.html / ru / es / hi / privacy / terms from templates" @("build.py")
+Run-Step "Generate zodiac sign pages (12 signs x 4 languages)" @("build_zodiac.py")
+Run-Step "Regenerate sitemap.xml" @("scripts/gen_sitemap.py")
+Run-Step "Validate build output" @("validate.py")
+
+Write-Host "Build OK." -ForegroundColor Green