One security aspect that I guess is out of scope for the audit is dealing with the threat model of a compromised server, which can insert a backdoor into the JavaScript code it delivers to the user.
A possible mitigation for this would be to support loading the site as a Secure Bookmark.[0] There might be technical and UX issues with doing this, but it would be interesting to know if it was at least possible to make it available as an option.
A possible mitigation for this would be to support loading the site as a Secure Bookmark.[0] There might be technical and UX issues with doing this, but it would be interesting to know if it was at least possible to make it available as an option.
[0] https://coins.github.io/secure-bookmark/