1<!doctype html> 2<html lang="en" style="overflow: hidden"> 3 <head> 4 <meta charset="utf-8" /> 5 <meta name="viewport" content="width=device-width, initial-scale=1" /> 6 <meta name="robots" content="index, follow" /> 7 8 <meta name="google-site-verification" content="xuNKA_HBxS97rxwbyWxmloMzVqksjSB4-ejlBjoJjt0" /> 9 10 <!-- Takes the credentials out of the address bar before any tag can read it, and hands the 11 original url to the app on window.__minvoEntryQuery / window.__minvoEntryPath (read 12 through src/utils/sensitiveUrlParams.ts, which holds the matching list and takes both 13 globals off window as soon as the bundle evaluates). 14 15 This has to be the first script on the page rather than part of the bundle: every tag 16 below reports the URL it loaded on, and the Meta pixel resolves document.location 17 itself â there is no argument on fbq that would let us redact it, so the only way it 18 never sees a sign-in code is for the code to be gone by the time it runs. --> 19
19<script> 20 ;(function () { 21 try { 22 var sensitive = ["token", "auth_jwt", "adminToken", "adminID", "uid", "code", "email"] 23 var url = new URL(window.location.href) 24 var found = false 25 for (var i = 0; i < sensitive.length; i++) { 26 if (url.searchParams.has(sensitive[i])) { 27 url.searchParams.delete(sensitive[i]) 28 found = true 29 } 30 } 31 // /social-redirect-abroad/<origin>/<userID>/<token> carries the same login token in 32 // the path, where searchParams cannot reach it â and every white-label user who 33 // connects a social account lands there on a full document load. The two segments are 34 // replaced rather than dropped so the route still matches and the screen still renders. 35 var segments = url.pathname.split("/") 36 if (segments[1] === "social-redirect-abroad" && segments.length >= 5) { 37 segments[3] = "redacted" 38 segments[4] = "redacted" 39 url.pathname = segments.join("/") 40 found = true 41 } 42 window.__minvoEntryQuery = window.location.search 43 window.__minvoEntryPath = window.location.pathname 44 if (found) window.history.replaceState(null, "", url.pathname + url.search + url.hash) 45 } catch (e) {} 46 })() 47 </script>
47 48 49 <meta name="og:type" content="website" /> 50 51 <meta name="theme-color" content="#ffffff" /> 52 <meta name="apple-mobile-web-app-status-bar-style" content="default" /> 53 54 <!-- Mirrors themeStore's default so the first paint is already the right theme: a stored choice 55 wins, otherwise white-label hosts are dark and Minvo is light. --> 56
56<script> 57 ;(function () { 58 try { 59 var stored = localStorage.getItem("theme") 60 var isWhiteLabelHost = /\.(church\.tech|gloo\.us)$/.test(location.hostname) 61 if (stored === "dark" || (stored !== "light" && isWhiteLabelHost)) document.documentElement.classList.add("dark") 62 } catch (e) {} 63 })() 64 </script>
64 65 66 <!-- Rewardful --> 67
67<script> 68 ;(function (w, r) { 69 w._rwq = r 70 w[r] = 71 w[r] || 72 function () { 73 ;(w[r].q = w[r].q || []).push(arguments) 74 } 75 })(window, "rewardful") 76 </script>
76 77
77<script async src="https://r.wdfl.co/rw.js" data-rewardful="ca0f66"></script>
77 78
78<script> 79 rewardful("ready", function () { 80 if (Rewardful.referral) { 81 localStorage.setItem("affiliateCode", Rewardful.referral) 82 } 83 }) 84 </script>
84 85 86 <!-- 87 manifest.json provides metadata used when your web app is installed on a 88 user's mobile device or desktop. See https://developers.google.com/web/fundamentals/web-app-manifest/ 89 --> 90 <link rel="manifest" href="/manifest.json" /> 91
91<script type="module" crossorigin src="/assets/index-C8XSz261.js"></script>
91 92 <link rel="stylesheet" crossorigin href="/assets/index-DESiYW40.css"> 93 </head> 94 <body> 95 <noscript>You need to enable JavaScript to run this app.</noscript> 96 97 <!-- Facebook --> 98
98<script> 99 window.fbAsyncInit = function () { 100 FB.init({ 101 appId: "417622453809551", 102 autoLogAppEvents: true, 103 xfbml: true, 104 version: "v22.0", // should we upgrade to version 21.0? 105 }) 106 } 107 </script>
107 108
108<script async defer crossorigin="anonymous" src="https://connect.facebook.net/en_US/sdk.js"></script>
108 109 110 <div id="root"></div> 111 </body> 112</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.