diff --git a/CHANGELOG.md b/CHANGELOG.md
index d0913fe..a1a9e0c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,16 @@
-# 0.4b0 (2016-09-30)
+# 0.5b0 (2016-09-02)
+
+* version bump for improved Mozilla Observatory rating publication on github
+
+# 0.4b1 (2016-09-01)
+
+* improved code so that A+ rating in Mozilla Observatory can be achieved
+* added HTTP header configuration to readme
+* modified the changelog so that it is more consistent
+* updated the readme to describe how an A+ rating can be achieved
+* tested improved code within chroot environment
+
+# 0.4b0 (2016-08-30)
* version bump for integrity-checking feature publication on github
@@ -8,7 +20,7 @@
* introduced subresource integrity for link and style elements
* added asmCrypto.js.map for better debugging support
* switched from server-defined PBKDF2 salt to JavaScript-generated salt
-* test implementation of new features within chroot environment
+* tested implementation of new features within chroot environment
# 0.3b0 (2016-08-25)
@@ -16,10 +28,10 @@
# 0.2b2 (2016-08-25)
-* improve length and handling of server-defined PBKDF2 salt
-* fix escaping of password-protected secrets
-* harmonize variable names of encryption and decryption code
-* test implementation of password-protection feature within chroot environment
+* improved length and handling of server-defined PBKDF2 salt
+* fixed escaping of password-protected secrets
+* harmonized variable names of encryption and decryption code
+* tested implementation of password-protection feature within chroot environment
# 0.2b1 (2016-08-24)
@@ -34,41 +46,41 @@
* introduce support for GPG passphrase via passphrase file
* simplified index file structure
* fixed message unstripping which produced undecryptable results for certain lengths
-* test implementation of shared-secrets service within chroot environment
+* tested implementation of shared-secrets service within chroot environment
# 0.1b4 (2016-08-16)
-* optimize copy-to-clipboard JavaScript integration
-* fix error message handling
-* add changelog file
+* optimized copy-to-clipboard JavaScript integration
+* fixed error message handling
+* added changelog file
# 0.1b3 (2016-08-15)
-* prepare publication on github
-* introduce config parameters for customization
-* update "how" page to be customizable
-* add license file
-* add readme file
+* prepared publication on github
+* introduced config parameters for customization
+* updated "how" page to be customizable
+* added license file
+* added readme file
# 0.1b2 (2016-08-15)
-* introduce copy-to-clipboard feature
-* disable auto-form-fill of browsers
+* introduced copy-to-clipboard feature
+* disabled auto-form-fill of browsers
# 0.1b1 (2016-08-15)
-* introduce cleaned-up code structure
-* introduce action handling code
-* introduce page handling code
-* introduce template handling code
-* introduce separate config.php file
+* introduced cleaned-up code structure
+* introduced action handling code
+* introduced page handling code
+* introduced template handling code
+* introduced separate config.php file
# 0.1a2 (2016-08-11)
-* allow URL-encoded and URL-unencoded secret URIs (Apple Mail bug)
-* publish to internal git versioning
+* allowed URL-encoded and URL-unencoded secret URIs (Apple Mail bug)
+* published to internal git versioning
# 0.1a1 (2016-08-11)
* initial PoC release
-* testing with first customer
+* tested with first customer
diff --git a/README.md b/README.md
index 22f15a2..0a40fb6 100644
--- a/README.md
+++ b/README.md
@@ -33,6 +33,39 @@ if (!-f $request_filename) {
}
```
+Shared-Secrets is designed to yield an A+ rating at the [Mozilla Observatory](https://observatory.mozilla.org) website check. Releases are checked against the Mozilla Observatory to make sure that a good rating can be achieved.
+
+To achieve an A+ rating with your instance, you have to implement TLS and non-TLS calls have to be redirected to the TLS-protected website (Nginx example):
+```
+server {
+ listen 80 default_server;
+ listen [::]:80 default_server;
+
+ server_name _;
+
+ return 301 https://$host$request_uri;
+}
+
+server {
+ listen 443 ssl http2 default_server;
+ listen [::]:443 ssl http2 default_server;
+
+ # Your configuration comes here:
+ # ...
+}
+```
+
+Furthermore the following HTTP headers have to be set (Nginx example):
+```
+add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self'";
+add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload";
+add_header X-Content-Security-Policy "default-src 'self'; frame-ancestors 'self'";
+add_header X-Content-Type-Options "nosniff";
+add_header X-Frame-Options "SAMEORIGIN";
+add_header X-Webkit-CSP "default-src 'self'; frame-ancestors 'self'";
+add_header X-XSS-Protection "1; mode=block";
+```
+
### MariaDB Setup
Shared-Secrets uses a single-table database to store who did retrieve which secret at what point in time. No actual secret content is stored. (The logging of IP addresses can be disabled through the configuration parameter LOG_IP_ADDRESS.):
@@ -70,21 +103,21 @@ It is strongly recommended to use TLS to protect the connection between the serv
## Attributions
-* asmCrypto (https://github.com/vibornoff/asmcrypto.js/): for providing PBKDF2 and AES functions
-* Bootstrap (https://getbootstrap.com): for providing an easy-to-use framework to build nice-looking applications
-* buffer (https://github.com/feross/buffer): for providing Base64-encoding and array-conversion functions
-* clipboard.js (https://clipboardjs.com): for simplifying the copy-to-clipboard use-case a lot
-* html5shiv (https://github.com/aFarkas/html5shiv): for handling Internet Explorer compatibility stuff
-* jQuery (https://jquery.com): for just existing
-* Katharina Franz (https://www.katharinafranz.com): for suggesting Bootstrap as an easy-to-use framework to build nice-looking applications
-* Respond.js (https://github.com/scottjehl/Respond): for handling even more Internet Explorer compatibility stuff
+* [asmCrypto](https://github.com/vibornoff/asmcrypto.js): for providing PBKDF2 and AES functions
+* [Bootstrap](https://getbootstrap.com): for providing an easy-to-use framework to build nice-looking applications
+* [buffer](https://github.com/feross/buffer): for providing Base64-encoding and array-conversion functions
+* [clipboard.js](https://clipboardjs.com): for simplifying the copy-to-clipboard use-case a lot
+* [html5shiv](https://github.com/aFarkas/html5shiv): for handling Internet Explorer compatibility stuff
+* [jQuery](https://jquery.com): for just existing
+* [Katharina Franz](https://www.katharinafranz.com): for suggesting Bootstrap as an easy-to-use framework to build nice-looking applications
+* [Respond.js](https://github.com/scottjehl/Respond): for handling even more Internet Explorer compatibility stuff
## ToDo
-* switch to the GnuPG PECL (https://pecl.php.net/package/gnupg) once the PHP 7 support is stable
-* switch to a more personalized design (current design is taken from https://github.com/twbs/bootstrap/tree/master/docs/examples/starter-template)
+* switch to the [GnuPG PECL](https://pecl.php.net/package/gnupg) once the PHP 7 support is stable
+* switch to a more personalized design (current design is taken from [here](https://github.com/twbs/bootstrap/tree/master/docs/examples/starter-template))
* implement an expiry date functionality
## License
-This application is released under the BSD license. See the LICENSE file for further information.
+This application is released under the BSD license. See the [LICENSE](LICENSE) file for further information.
diff --git a/index.php b/index.php
index b91eaae..43ee8f0 100644
--- a/index.php
+++ b/index.php
@@ -1,6 +1,6 @@