Change Details

## Summary The contents of `secure-api.js` can be self-hosted. We should consider doing this for improved auditability, especially if/when the contents change. ## Specification `secure-api.js` should be loaded from a versioned store in Extension:ConfirmEdit, and not via the `hcaptcha.wikimedia.org` proxy. The `endpoint`, `assethost`, and other query parameters should continue to be set to values that use the proxy. ## Technical notes TBD ## Acceptance criteria - [ ] secure-api.js is stored in a publicly versioned repository - [ ] secure-api.js is loaded via the publicly versioned repository, and not the proxy - [ ] Requests to hCaptcha from the client continue to route through the proxy

## Summary The contents of `secure-api.js` can be self-hosted. We should consider doing this for improved auditability, especially if/when the contents change. ## Specification `secure-api.js` should be loaded from a versioned store in Extension:ConfirmEdit, and not via the `hcaptcha.wikimedia.org` proxy. The `endpoint`, `assethost`, and other query parameters should continue to be set to values that use the proxy. ## Technical notes TBD ## Acceptance criteria - [ ] secure-api.js is stored in a publicly versioned repository - [ ] secure-api.js is loaded directly or indirectly via the publicly versioned repository - [ ] After loading our self-hosted secure-api.js, requests to hCaptcha from the client continue to route through the proxy

## Summary The contents of `secure-api.js` can be self-hosted. We should consider doing this for improved auditability, especially if/when the contents change. ## Specification `secure-api.js` should be loaded from a versioned store in Extension:ConfirmEdit, and not via the `hcaptcha.wikimedia.org` proxy. The `endpoint`, `assethost`, and other query parameters should continue to be set to values that use the proxy. ## Technical notes TBD ## Acceptance criteria - [ ] secure-api.js is stored in a publicly versioned repository - [ ] secure-api.js is loaded directly or indirectly via the publicly versioned repository, and not the proxy - [ ] RAfter loading our self-hosted secure-api.js, requests to hCaptcha from the client continue to route through the proxy