From a5e116b4f18adb6399d4a687ac5d000014bedef1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 18 Mar 2026 15:59:04 +0000
Subject: [PATCH 1/3] Initial plan


From 6b6d244228553dc5ceb2e7bbff2d6ea338c331c1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 18 Mar 2026 16:12:59 +0000
Subject: [PATCH 2/3] Add CSP meta tag and fix empty subscribe error handlers

Co-authored-by: numbers-official <181934381+numbers-official@users.noreply.github.com>
---
 src/app/features/contacts/contacts.page.ts    |  5 +++-
 .../features/data-policy/data-policy.page.ts  |  5 +++-
 src/app/features/signup/signup.page.ts        | 10 +++++--
 .../wallets/transfer/transfer.page.ts         | 30 ++++++++++++++-----
 src/app/features/wallets/wallets.page.ts      | 25 ++++++++++++----
 src/index.html                                | 13 ++++++++
 6 files changed, 72 insertions(+), 16 deletions(-)

diff --git a/src/app/features/contacts/contacts.page.ts b/src/app/features/contacts/contacts.page.ts
index e86c7531d..b62ae75d0 100644
--- a/src/app/features/contacts/contacts.page.ts
+++ b/src/app/features/contacts/contacts.page.ts
@@ -46,7 +46,10 @@ export class ContactsPage {
         catchError((err: unknown) => this.errorService.toastError$(err)),
         untilDestroyed(this)
       )
-      .subscribe();
+      .subscribe({
+        // eslint-disable-next-line no-console
+        error: (err: unknown) => console.error(err),
+      });
   }
 
   // eslint-disable-next-line class-methods-use-this
diff --git a/src/app/features/data-policy/data-policy.page.ts b/src/app/features/data-policy/data-policy.page.ts
index 5a67ddb3e..4c2e41934 100644
--- a/src/app/features/data-policy/data-policy.page.ts
+++ b/src/app/features/data-policy/data-policy.page.ts
@@ -44,6 +44,9 @@ export class DataPolicyPage {
         }),
         untilDestroyed(this)
       )
-      .subscribe();
+      .subscribe({
+        // eslint-disable-next-line no-console
+        error: (err: unknown) => console.error(err),
+      });
   }
 }
diff --git a/src/app/features/signup/signup.page.ts b/src/app/features/signup/signup.page.ts
index 385dc5a40..4b4d2b477 100644
--- a/src/app/features/signup/signup.page.ts
+++ b/src/app/features/signup/signup.page.ts
@@ -70,7 +70,10 @@ export class SignupPage {
         ),
         untilDestroyed(this)
       )
-      .subscribe();
+      .subscribe({
+        // eslint-disable-next-line no-console
+        error: (err: unknown) => console.error(err),
+      });
   }
 
   private createFormFields(
@@ -237,7 +240,10 @@ export class SignupPage {
     this.blockingActionService
       .run$(action$)
       .pipe(untilDestroyed(this))
-      .subscribe();
+      .subscribe({
+        // eslint-disable-next-line no-console
+        error: (err: unknown) => console.error(err),
+      });
   }
 
   private handleOnSubmitError(err: unknown) {
diff --git a/src/app/features/wallets/transfer/transfer.page.ts b/src/app/features/wallets/transfer/transfer.page.ts
index 2a9b8484d..3a854ffed 100644
--- a/src/app/features/wallets/transfer/transfer.page.ts
+++ b/src/app/features/wallets/transfer/transfer.page.ts
@@ -65,9 +65,13 @@ export class TransferPage {
     private readonly platform: Platform,
     private readonly snackBar: MatSnackBar
   ) {
-    this.activeRoute.paramMap.subscribe(paramMap => {
-      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-      this.mode = paramMap.get('mode')!;
+    this.activeRoute.paramMap.subscribe({
+      next: paramMap => {
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        this.mode = paramMap.get('mode')!;
+      },
+      // eslint-disable-next-line no-console
+      error: (err: unknown) => console.error(err),
     });
   }
 
@@ -84,7 +88,10 @@ export class TransferPage {
         ),
         untilDestroyed(this)
       )
-      .subscribe();
+      .subscribe({
+        // eslint-disable-next-line no-console
+        error: (err: unknown) => console.error(err),
+      });
   }
 
   onInputTransferAmount() {
@@ -98,7 +105,10 @@ export class TransferPage {
           this.translocoService.translate('error.wallets.emptyTransferAmount')
         )
         .pipe(untilDestroyed(this))
-        .subscribe();
+        .subscribe({
+          // eslint-disable-next-line no-console
+          error: (err: unknown) => console.error(err),
+        });
       return;
     }
 
@@ -156,7 +166,10 @@ export class TransferPage {
         }),
         untilDestroyed(this)
       )
-      .subscribe();
+      .subscribe({
+        // eslint-disable-next-line no-console
+        error: (err: unknown) => console.error(err),
+      });
   }
 
   transfer() {
@@ -180,7 +193,10 @@ export class TransferPage {
         finalize(() => dialogRef.close()),
         untilDestroyed(this)
       )
-      .subscribe();
+      .subscribe({
+        // eslint-disable-next-line no-console
+        error: (err: unknown) => console.error(err),
+      });
   }
 
   openTransferRequestSentDialog() {
diff --git a/src/app/features/wallets/wallets.page.ts b/src/app/features/wallets/wallets.page.ts
index 4526653a5..9fa93233d 100644
--- a/src/app/features/wallets/wallets.page.ts
+++ b/src/app/features/wallets/wallets.page.ts
@@ -90,7 +90,10 @@ export class WalletsPage {
         }),
         untilDestroyed(this)
       )
-      .subscribe();
+      .subscribe({
+        // eslint-disable-next-line no-console
+        error: (err: unknown) => console.error(err),
+      });
   }
 
   private reloadPage() {
@@ -103,7 +106,10 @@ export class WalletsPage {
         }),
         untilDestroyed(this)
       )
-      .subscribe();
+      .subscribe({
+        // eslint-disable-next-line no-console
+        error: (err: unknown) => console.error(err),
+      });
   }
 
   private copyToClipboardAssetWallet() {
@@ -113,7 +119,10 @@ export class WalletsPage {
         concatMap(assetWalletAddr => this.copyToClipboard(assetWalletAddr)),
         untilDestroyed(this)
       )
-      .subscribe();
+      .subscribe({
+        // eslint-disable-next-line no-console
+        error: (err: unknown) => console.error(err),
+      });
   }
 
   private copyToClipboardIntegrityWallet() {
@@ -123,7 +132,10 @@ export class WalletsPage {
         concatMap(publicKey => this.copyToClipboard(publicKey)),
         untilDestroyed(this)
       )
-      .subscribe();
+      .subscribe({
+        // eslint-disable-next-line no-console
+        error: (err: unknown) => console.error(err),
+      });
   }
 
   private copyToClipboardPrivateKey() {
@@ -133,7 +145,10 @@ export class WalletsPage {
         concatMap(privateKey => this.copyToClipboard(privateKey)),
         untilDestroyed(this)
       )
-      .subscribe();
+      .subscribe({
+        // eslint-disable-next-line no-console
+        error: (err: unknown) => console.error(err),
+      });
   }
 
   navigateToBuyNumPage() {
diff --git a/src/index.html b/src/index.html
index cbe060b91..46c2cdc47 100644
--- a/src/index.html
+++ b/src/index.html
@@ -14,6 +14,19 @@
     <meta name="format-detection" content="telephone=no" />
     <meta name="msapplication-tap-highlight" content="no" />
 
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self';
+               frame-src https://*.numbersprotocol.io https://*.bubble.io;
+               connect-src https://*.numbersprotocol.io;
+               script-src 'self';
+               style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
+               font-src 'self' https://fonts.gstatic.com;
+               img-src 'self' data: blob:;
+               media-src 'self' blob:;
+               object-src 'none';"
+    />
+
     <link
       rel="preload"
       as="image"

From 72fbe6bb4804415bef1ddb5fa4c26872a039694d Mon Sep 17 00:00:00 2001
From: Omni <omni@numbersprotocol.io>
Date: Thu, 16 Apr 2026 06:03:40 +0000
Subject: [PATCH 3/3] fix: remove CSP meta tag to prevent runtime breakage

The Content-Security-Policy was too restrictive for a Capacitor mobile
app. connect-src only allowed *.numbersprotocol.io, which would silently
block requests to bubble.io APIs (actions, orders, NUM price), GoPro
local server (10.5.5.9), and AppsFlyer analytics at runtime.

CSP for Capacitor apps requires a dedicated effort with comprehensive
domain inventory and full QA coverage across all features.
---
 src/index.html | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/src/index.html b/src/index.html
index 46c2cdc47..cbe060b91 100644
--- a/src/index.html
+++ b/src/index.html
@@ -14,19 +14,6 @@
     <meta name="format-detection" content="telephone=no" />
     <meta name="msapplication-tap-highlight" content="no" />
 
-    <meta
-      http-equiv="Content-Security-Policy"
-      content="default-src 'self';
-               frame-src https://*.numbersprotocol.io https://*.bubble.io;
-               connect-src https://*.numbersprotocol.io;
-               script-src 'self';
-               style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
-               font-src 'self' https://fonts.gstatic.com;
-               img-src 'self' data: blob:;
-               media-src 'self' blob:;
-               object-src 'none';"
-    />
-
     <link
       rel="preload"
       as="image"