{
  "date": "2026-11-07",
  "scope": "Local browser reproduction from INOBIC source, synthetic input only; owned Azure Static Web Apps configuration reviewed read-only. No customer or tenant data in this export.",
  "finding": "Native GET fallback of email composer if JavaScript is unavailable",
  "before": {
    "method": "GET",
    "observedLocalUrl": "/before.html?need=application&message=AUDIT-SYNTHETIQUE-AUCUNE-DONNEE-REELLE&timing=&budget=",
    "result": "synthetic message present in URL"
  },
  "after": {
    "withoutJavaScript": "form invisible, direct email available",
    "withJavaScript": "form visible, selected need preserved, clipboard summary with actual newlines",
    "defenceInDepth": "forced visible native form could not navigate under form-action none",
    "inlineScriptProbe": "marker unchanged under script-src self"
  },
  "limits": [
    "No evidence of past exploitation or actual personal data leakage",
    "Local browser tests, not all browser implementations",
    "Azure tenant identities and other resources outside resource group excluded",
    "Self-produced with Codex assistance, not independent validation"
  ]
}