[vishprometa]

Adds the six completed SUNDAY, NOCTURNE, THALASSA, PARALLAX, ROOK, and Elsewhere websites plus 18 earlier completed builds that were missing from the catalog. The existing 99 entries remain intact; the catalog now contains 80 websites and 43 business-app prompts.

The original source, assets, licenses, and existing earlier prompts are preserved. The recent sites include complete implementation specifications and original asset-generation briefs. Portable resource/collection paths allow the previews and downloaded packages to work outside their original hosting roots. Each addition has an actual browser-captured thumbnail. SUNDAY leads the new website entries.

Validation: catalog schema passes for 123 entries; all eight catalog/download tests pass; all 24 homepages inspected in the browser with no desktop page overflow and visible assets loaded. Source packages were scanned for local private paths and credential material. Model and font licenses are retained.

Catalog source review

The 45 CodeQL annotations on the initial import reduce to two repeated patterns in previously completed source:

• 30 js/dom-text-reinterpreted-as-html annotations repeat Latch's same inline implementation across five pages. The source is the page's authored application/json fixture, not a request, user input, or remote response. Fixed flag/environment metadata is rendered from that fixture. Editable context and condition values are separately normalized/validated and passed through the existing e HTML-escaping helper before insertion. Invalid saved configuration is rejected; condition IDs are restricted to alphanumeric/hyphen strings. No backend, authentication, remote settings or account data exists in this local simulation. The broad DOM-source warning does not establish a user-controlled injection path in the delivered implementation.
• 15 js/insecure-randomness annotations repeat bundled Three.js MathUtils.generateUUID. It assigns local graphics object/texture IDs. Neither site uses those IDs as authentication, authorization, passwords, secret tokens or server-side security identifiers. Both demos have no authentication/backend. The canonical source and pinned package lock are included so the vendored code's role is inspectable.

No security scanner was disabled, no alerts were hidden by changing scanning scope, and no dependency bundle was hand-edited. Prompt Markdown added to the platform is sanitized on the server with a strict readable-document tag/attribute allowlist. Tests cover executable HTML, unsafe JavaScript links, tracking images, iframe/form controls, and heading hierarchy.

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.