TODO

• With logout disabled the administrator answers with script-src-attr 'self' (measured on the compose stack: response header of /administrator/index.php), so inline event handlers are blocked. Measured on the user and plugin lists: a click on the check-all box (input[name="checkall-toggle"], inline onclick) checks 0 rows and the browser reports a script-src-attr violation; the pagination links (a.page-link) carry inline onclick handlers too. meta/csp.yml allows 'unsafe-inline' for script-src-elem and style-src-attr only, and plugins/filter/csp_filters.py adds it to script-src-attr solely when logout is enabled. Options: add script-src-attr: unsafe-inline to meta/csp.yml, or cover the path with a Playwright test first and decide then.

• tasks/07_reset_admin_password.yml:16 passes JOOMLA_USER_PASSWORD as --password argument, tasks/03_install.yml:53 and :57 expand J_DB_PASSWORD and J_ADMIN_PASSWORD into --db-pass= and --admin-password=, and tasks/05_patch.yml:10 hands the database password to container exec as -e J_DBPASS=, so each secret is in the process list of the stack host and in the deploy log while its task runs (read from the task files, not measured). Options: feed the values through stdin next to a PHP script, as tasks/09_design.yml does with its payload, or through an env file inside the container.