[Yutsa]

Why

A content creator browsing the site while filming leaked their e-mail address: for a signed-in user, the homepage newsletter field was filled with the account's address (value="<?= h($email) ?>"), visible as soon as the page loaded. The address was also shown in full in the account menu and on the account page, with the same risk on a stream or a video.

How

• Newsletter (includes/newsletter_sub.php): the field is never filled (and has autocomplete="off"). Signed-in users get a « Utiliser l'adresse de mon compte » button: it submits nl_use_account and the server takes the address from the session, so the page never contains it.
• Design system: new tooltip.css (ac-tooltip, --start, --below, ac-tooltip-host, ac-masked), doc docs/components/tooltip.md, section on /pages/design-system. Helpers in php/ui.php: dsMaskEmail() (c•••@gmail.com) and ac_masked_email() (masked address, full one in a tooltip shown on hover, keyboard focus, or a tap on touch screens).
• Masked address: account menu of the azure theme (tooltip below, the menu scrolls and would clip it; .az-am-sub no longer clips), account page (profile header and newsletter sentence), hello-world demo page.
• Files to review: includes/newsletter_sub.php, design-system/css/components/tooltip.css, design-system/php/ui.php.

Outcomes

Homepage newsletter, signed in: empty field, « Utiliser l'adresse de mon compte » under it.

Account page: address masked, in full in the tooltip on focus or hover.

Account menu: same, tooltip under the address.

• php tests/run.php: 125 passed (masking, escaping, no value on the newsletter field)
• e2e tests/e2e/newsletter-email.spec.ts, desktop and mobile: the page text never contains the full address, tooltip shows on focus/hover, the account button subscribes
• Account page newsletter block: only shown with Listmonk, not configured on the local stack (same helper as the profile header)

🤖 Generated with Claude Code

[github-actions]

⚠️ Loading: CLS over budget

Not a failure: the CLS of a screen varies from one CI run to the next. Each screenshot is the settled page, the boxes that moved drawn on it (dashed: before, solid: after). Frame by frame: npm run loading:timeline -- <screen> in tests/e2e. Run: https://github.com/Altered-Community/alteredcore-website/actions/runs/39770693158

desktop · editor, Main, second visit at 1280 px: skeleton until the first screen, styled, no layout shift

CLS 0.2018 (budget 0.01)

Shifts

1124 ms  0.0006
  x623 y111 217×24 → x545 y111 217×24 (img < ac-badge.ac-badge < ac-rarity-limits)
  x856 y111 87×24 → x778 y111 165×24 (ac-badge.ac-badge.ac-badge--orange < button.legality < app-deck-bar.reduced)
  x606 y97 1×52 → x528 y97 1×52 (span.sep < app-deck-bar.reduced < div.top)
1234 ms  0.2012
  x24 y306 908×466 → x0 y0 0×0
  x157 y242 147×40 → x181 y242 171×40 (button.ac-button.ac-button--secondary < div.toolbar < app-test-hand)
  x24 y796 908×4 → x0 y0 0×0