From andy:
On your leaderboard question — yes, it's possible and a nice fit. The leaderboard lives in the hive ( /leaderboard route + style dropdown). Design for a URL-param custom style from a public GH repo:
• URL shape: /leaderboard?style=owner/repo/path/theme.css (optionally @ref , default branch otherwise)
• Server-side fetch of raw.githubusercontent.com/owner/repo/ref/path — never client-side: keeps CSP intact ( style-src 'self' ), hides viewer IPs from third parties, lets us cache + enforce a size cap (e.g. 128KB)
• Constraints for safety: public GitHub only, path must end .css , served through a sanitizing pass (strip @import / url() to external origins to block CSS exfiltration/beacons), cached with a short TTL
• Dropdown gains a "Custom (from URL)" entry showing the active source; bad/unfetchable style falls back to default with a small notice
From andy:
On your leaderboard question — yes, it's possible and a nice fit. The leaderboard lives in the hive ( /leaderboard route + style dropdown). Design for a URL-param custom style from a public GH repo:
• URL shape: /leaderboard?style=owner/repo/path/theme.css (optionally @ref , default branch otherwise)
• Server-side fetch of raw.githubusercontent.com/owner/repo/ref/path — never client-side: keeps CSP intact ( style-src 'self' ), hides viewer IPs from third parties, lets us cache + enforce a size cap (e.g. 128KB)
• Constraints for safety: public GitHub only, path must end .css , served through a sanitizing pass (strip @import / url() to external origins to block CSS exfiltration/beacons), cached with a short TTL
• Dropdown gains a "Custom (from URL)" entry showing the active source; bad/unfetchable style falls back to default with a small notice