From a620b6a238c6ea13ec993226c490e06e17db2b8d Mon Sep 17 00:00:00 2001
From: Hamdi LAADHARI <killerwolf06@gmail.com>
Date: Mon, 7 Sep 2026 16:45:08 +0200
Subject: [PATCH] fix(site): stop Cloudflare rewriting the CDN snippet as an
 email address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The landing page's install snippet went live reading

  https://cdn.jsdelivr.net/npm/@h4md1/[email protected]/dist/...

Cloudflare proxies h4md1.fr, and its Email Address Obfuscation feature
matched "visual-image-tool@0.3.0" as an address, replacing it with a
mailto-decoding <a> and injecting its email-decode script. Anyone copying
the CDN line got a dead URL — the one snippet on the page whose entire job
is to be copied.

It only appeared once the version was pinned: the previous "@0.2" has a
single dot and didn't look domain-like enough to match.

Wraps the block in Cloudflare's documented email_off opt-out, which works
from the page without touching the dashboard.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 demo/index.html | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/demo/index.html b/demo/index.html
index ab738b3..438ed40 100644
--- a/demo/index.html
+++ b/demo/index.html
@@ -652,7 +652,12 @@ <h2>Install</h2>
           Or skip the install entirely and load it from a CDN — this is what the
           demo above does. Pin the exact version in production.
         </p>
+        <!-- Cloudflare's email obfuscation reads "visual-image-tool@0.3.0"
+           as an address and rewrites it to [email protected], which breaks
+           the snippet for anyone who copies it. email_off is its opt-out. -->
+        <!--email_off-->
         <pre><code class="language-html">&lt;script src="https://cdn.jsdelivr.net/npm/@h4md1/visual-image-tool@0.3.0/dist/visual-image-tool.umd.js"&gt;&lt;/script&gt;</code></pre>
+        <!--email_on-->
         <p class="sub">
           There is a runnable
           <a href="https://jsfiddle.net/ugswzmo2/">JSFiddle</a>