English

Within the application-focused generic top-level domain (.app), 'studiovel.app' is registered. The core label 'studiovel' covers 9 characters containing 4 vowels alongside 5 consonants. Segmentation suggests two words: studio, vel. Median word length is 4.5 characters. No strong language cues emerged from the frequency lists.

html/af/b5/afb58400-f91f-46a5-bb4a-7385b76237b2.html.gz

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

b84053a309e807a804a1408881a4f8fd6d5ca384ef538fbef02934f57a93c102

94fa34d95d5ba640ed9365a12bbf0d06ef1fceaed176d98c8195c26e8be0611b

710ddeff850df9f12ecbf38ef9d9f3dfeb12907215adf51c5262cb97936a8fc2

55af4ce8fa22354f0af4b223dc8c0bc2f6650e8f95baa5d656bf6942452e9d05

dd9939f5e0a3a4d8d889767af6731d2480d480514d11ba2ddeea54416f6c6388

c81e9c9cbdaf975c3167a64563097ab2fc777a01e4e09284137d11126d77e6dd

3146b86f25b3e58cc2ef41a2d4ad7cac52fc219d0a66ac3ec9fd0c63c3a21349

9bdf4d7f7b93e41b428fc07ccb814cf12bb4ac527b608b0f0d771bf9d81d6c7b

53b5d40b0fbe4a96ea85f508ac0bce2b5edd1ab7278d8db29346f92ccd519e1d

1abf20251d63cf53c4090c8a4235227ef2515e3929daa2a4768a872917e11eba

viewport

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

Abuse Team

Namecheap Inc.

studiovel.app


//==================================================================
// STATE
//==================================================================
const ANGLES = [
  { id: "front",    label: "Front v


/* ==================================================================
   CUSTOMER SUPPORT — Phase 1 wiring (empty scaffold)
   ==================================================================
   - Gates the "Customer support" nav item behind /api/support/health
     (admin + support roles only).
   - Applies body.support-mode class for full-screen takeover.
   - Remembers the previously active tab so "Back to StudioVel" returns there.
   - Loads ticket counts + labels for nav decoration.

   State is DOM-local (no module state yet): since the tab panels are
   just display-toggled, the DOM stays mounted across tab switches, so
   any selected ticket / draft reply / scroll position naturally persists
   without explicit save/restore. Richer state (selected ticket id, etc.)
   gets wired in Phase 2.
   ================================================================== */
(function(){
  const navSupport = document.querySelector('[data-tab="support"]');
  const panel      = document.querySelector('[data-panel="support"]');
  if (!navSupport || !panel) return;

  const backBtn     = document.getElementById("supBackBtn");
  const labelsList  = document.getElementById("supLabelsList");
  const badgeEl     = document.getElementById("navSupportBadge");
  let   prevTab     = "images";

  function escHtml(s) {
    return String(s == null ? "" : s).replace(/[&<>"']/g, function(c){
      return { "&":"&amp;", "<":"&lt;", ">":"&gt;", '"':"&quot;", "'":"&#039;" }[c];
    });
  }

  // Remember the previous active tab before switching INTO support.
  // Then apply the full-screen takeover class after the normal tab switch
  // has landed (the tab handler runs on the same click; we defer by a tick).
  //
  // Safety net: we also scroll to (0,0) and relocate the panel to be a direct
  // child of <body> the first time support is opened. Moving it out of
  // .main-area guarantees no ancestor container (with padding, transforms,
  // animations, or stacking contexts) can shift the fixed-positioned panel
  // away from the top of the viewport. This is belt-and-suspenders for the
  // "renders at the bottom of the viewport" bug.
  let _panelRelocated = false;
  function _relocatePanelToBody() {
    if (_panelRelocated) return;
    if (panel && panel.parentElement !== document.body) {
      document.body.appendChild(panel);
    }
    _panelRelocated = true;
  }

  navSupport.addEventListener("click", function() {
    const active = document.querySelector(".nav-item.active");
    if (active && active !== navSupport) {
      const t = active.getAttribute("data-tab");
      if (t && t !== "support") prevTab = t;
    }
    setTimeout(function(){
      document.body.classList.add("support-mode");
      _relocatePanelToBody();
      window.scrollTo(0, 0);

      // Decide: show wizard or helpdesk.
      // _supOnboardingCache is set by checkAccess() below.
      if (typeof window.supWizardShouldShow === "function" && window.supWizardShouldShow(_supOnboardingCache)) {
        if (typeof window.supWizardOpen === "function") window.supWizardOpen(_supRoleCache);
      } else {
        if (typeof window.supWizardClose === "function") window.supWizardClose();
      }
    }, 0);
  }, true);

  // Back to StudioVel → drop takeover + restore previous tab
  if (backBtn) {
    backBtn.addEventListener("click", function() {
      document.body.classList.remove("support-mode");
      const target = document.querySelector('[data-tab="' + prevTab + '"]');
      if (target) target.click();
    });
  }

  // Cache the last onboarding state so the click handler above doesn't need
  // to re-fetch /health every time. Refreshed whenever checkAccess() runs.
  let _supOnboardingCache = null;
  let _supRoleCache = "user";

  // Check role access. The nav item is now always visible when logged in
  // (shown by hidePaywallAffordances), but we still use /api/support/health to
  // decide whether to load ticket data vs show the "connect Shopify" onboarding
  // message inside the panel.
  async function checkAccess() {
    try {
      const res = await fetch("/api/support/health");
      if (!res.ok) return;
      const data = await res.json();
      if (data && data.hasAccess) {
        // Nav item is already visible via hidePaywallAffordances; no need to re-show.
        // Also reveal the "Customer Support" entry in the user-menu dropdown
        const menuSupport = document.getElementById("menuSupportLink");
        if (menuSupport) menuSupport.style.display = "";
        _supOnboardingCache = data.onboarding || null;
        _supRoleCache = data.role || "user";
        // Expose globally so Phase-2 applyCounts can read it for lock-badge state
        window._supOnboardingCache = _supOnboardingCache;
        window._supRoleCache = _supRoleCache;
        loadNavData();
      }
      // If no access (no Shopify connected), panel will show its onboarding
      // state when the user clicks the nav — no nav-hiding required.
    } catch (e) { /* silent — panel just shows the onboarding state */ }
  }

  // Load tickets + labels to paint the nav counts and the label pills.
  async function loadNavData() {
    try {
      const [tRes, lRes] = await Promise.all([
        fetch("/api/support/tickets"),
        fetch("/api/support/labels"),
      ]);
      if (tRes.ok) {
        const data = await tRes.json();
        applyCounts(data.counts || {});
      }
      if (lRes.ok) {
        const data = await lRes.json();
        renderLabels(data.labels || []);
      }
    } catch (e) { /* silent for Phase 1 */ }
  }

  function applyCounts(counts) {
    // Fill every [data-sup-count="<key>"] element with counts[key]
    document.querySelectorAll("[data-sup-count]").forEach(function(el){
      const key = el.getAttribute("data-sup-count");
      const val = counts[key] != null ? counts[key] : 0;
      el.textContent = String(val);
    });
    // Sidebar badge: number of open tickets, hidden if zero
    if (badgeEl) {
      const open = counts.open != null ? counts.open : 0;
      if (open > 0) { badgeEl.textContent = String(open); badgeEl.style.display = ""; }
      else { badgeEl.style.display = "none"; }
    }
  }

  function renderLabels(labels) {
    if (!labelsList) return;
    // Respect showOnSidebar=false flag: those labels still exist on tickets
    // and in the add-label picker, but don't appear in the left sidebar.
    const visible = (labels || []).filter(l => l.showOnSidebar !== false);
    if (!visible.length) {
      labelsList.innerHTML = '<div style="font-size:11.5px;color:var(--muted-2);padding:4px 8px;">No labels yet</div>';
      return;
    }
    labelsList.innerHTML = visible.map(function(l){
      const bg    = l.bg    || "var(--bg)";
      const color = l.color || "#334155";
      return '<div class="sup-label-pill" style="background:' + bg + ';color:' + color + ';" data-label-id="' + escHtml(l.id) + '">'
           +   '<span class="dot" style="background:' + color + ';"></span>'
           +   '<span class="label-name">' + escHtml(l.name) + '</span>'
           +   '<span class="sup-label-del" data-del-label="' + escHtml(l.id) + '" title="Delete label">&times;</span>'
           + '</div>';
    }).join("");
  }
  // Expose so Phase 2 can call it after creating a new label
  window.__supRepaintLabels = function() {
    fetch("/api/support/labels").then(r => r.json()).then(data => {
      renderLabels(data.labels || []);
    }).catch(() => {});
  };

  // Org-nav button activation (visual only for Phase 1 — filtering lands in Phase 2)
  panel.querySelectorAll(".sup-nav-link").forEach(function(btn){
    btn.addEventListener("click", function(){
      panel.querySelectorAll(".sup-nav-link").forEach(function(x){ x.classList.remove("active"); });
      btn.classList.add("active");
    });
  });
  // Inbox scope tabs: Phase 2 wires these with state + rendering. Don't
  // double-bind here or the redundant handler races with Phase 2's and can
  // swap `.active` back after a filter change.

  // Kick off access check on boot. Runs independently of fetchCurrentUser.
  checkAccess();
})();



/* ==================================================================
   CUSTOMER SUPPORT — top bar store chip dropdown
   ==================================================================
   Turns the #supStoreChip button in the helpdesk topbar into a real
   dropdown populated from /api/support/stores. Selecting a store filters
   the inbox to that store's tickets; "All stores" clears the filter.
   ================================================================== */
(function(){
  function escHtml(s) {
    return String(s == null ? "" : s).replace(/[&<>"']/g, function(c){
      return { "&":"&amp;", "<":"&lt;", ">":"&gt;", '"':"&quot;", "'":"&#039;" }[c];
    });
  }

  // ---------- Customer support: store picker dropdown ----------
  const supStoreChip = document.getElementById("supStoreChip");
  const supStoreName = document.getElementById("supStoreName");
  let supStores = [];
  let supSelectedStoreId = null; // null = "all stores"
  let supDropdownEl = null;

  async function reloadSupportStores() {
    try {
      const res = await fetch("/api/support/stores");
      if (!res.ok) return;
      const data = await res.json();
      supStores = data.stores || [];
      const inboxLabel = document.getElementById("supInboxStoreLabel");
      // Pick a sensible default: primary store, or "all stores" if multiple, or first
      if (supStores.length === 0 || supStores[0].placeholder) {
        supSelectedStoreId = null;
        if (supStoreName) supStoreName.textContent = "No store connected";
        if (inboxLabel) inboxLabel.textContent = "Your store";
      } else if (supStores.length === 1) {
        supSelectedStoreId = supStores[0].id;
        if (supStoreName) supStoreName.textContent = supStores[0].name;
        if (inboxLabel) inboxLabel.textContent = supStores[0].name;
      } else {
        const primary = supStores.find(function(s){ return s.isPrimary; }) || supStores[0];
        supSelectedStoreId = primary.id;
        if (supStoreName) supStoreName.textContent = primary.name;
        if (inboxLabel) inboxLabel.textContent = primary.name;
      }
    } catch (e) { /* silent */ }
  }
  window.reloadSupportStores = reloadSupportStores;

  function toggleStoreDropdown() {
    if (!supStoreChip || supStores.length === 0) return;
    // If this popup is already open, clicking the chip toggles it closed.
    if (supDropdownEl && window.supIsPopupOpen(supDropdownEl)) {
      window.supClosePopup();
      supDropdownEl = null;
      return;
    }

    supDropdownEl = document.createElement("div");
    supDropdownEl.style.cssText = "position:fixed;background:var(--surface);border:1px solid var(--border);border-radius:9px;box-shadow:0 10px 30px rgba(15,23,42,0.12);padding:6px;min-width:220px;z-index:10001;font-family:inherit;";
    const rect = supStoreChip.getBoundingClientRect();
    supDropdownEl.style.top  = (rect.bottom + 6) + "px";
    supDropdownEl.style.left = rect.left + "px";

    const rows = [];
    if (supStores.length > 1) {
      rows.push({ id: null, name: "All stores", color: "#1A1A1A", all: true });
    }
    rows.push.apply(rows, supStores.filter(function(s){ return !s.placeholder; }));

    rows.forEach(function(s){
      const row = document.createElement("button");
      row.type = "button";
      row.style.cssText = "display:flex;align-items:center;gap:9px;padding:8px 10px;border-radius:6px;background:none;border:none;cursor:pointer;width:100%;text-align:left;font-family:inherit;font-size:13px;color:var(--ink);transition:background 0.12s;";
      const isSelected = (s.id === supSelectedStoreId);
      if (isSelected) row.style.background = "var(--gold-soft)";
      row.innerHTML = ''
        + '<span style="width:10px;height:10px;border-radius:50%;background:' + (s.color || "#94a3b8") + ';flex-shrink:0;"></span>'
        + '<span style="flex:1;font-weight:' + (isSelected ? "600" : "500") + ';">' + escHtml(s.name) + '</span>'
        + (isSelected ? '<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="#22D3EE" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="20 6 9 17 4 12"/></svg>' : '');
      row.addEventListener("mouseenter", function(){ if (!isSelected) row.style.background = "#f8fafc"; });
      row.addEventListener("mouseleave", function(){ if (!isSelected) row.style.background = "transparent"; });
      row.addEventListener("click", function(){
        supSelectedStoreId = s.id;
        if (supStoreName) supStoreName.textContent = s.name;
        window.supClosePopup();
        supDropdownEl = null;
        if (typeof window._supSetStore === "function") window._supSetStore(s.id);
      });
      supDropdownEl.appendChild(row);
    });

    window.supOpenPopup(supDropdownEl, supStoreChip, function(){ supDropdownEl = null; });
  }

  if (supStoreChip) {
    supStoreChip.addEventListener("click", function(e){
      console.log("[store] chip clicked", { hasSupOpenPopup: typeof window.supOpenPopup, stores: supStores.length });
      e.stopPropagation();
      toggleStoreDropdown();
    });
  }

  // Refresh support stores whenever the user opens the helpdesk
  const navSupport = document.querySelector('[data-tab="support"]');
  if (navSupport) {
    navSupport.addEventListener("click", function(){ setTimeout(reloadSupportStores, 100); });
  }
  // Initial load
  setTimeout(reloadSupportStores, 400);
})();



/* ==================================================================
   SIMPLE POPUP HELPER — one function, no registry, no cross-popup magic.
   ==================================================================
   Usage:
     const popup = document.createElement('div');
     // position it yourself, then:
     supOpenPopup(popup, triggerButton, onClose);

   Behavior:
   - Auto-closes when user clicks anywhere NOT inside popup or trigger.
   - Auto-closes on Escape.
   - Calling supOpenPopup again with the SAME trigger toggles (close if open).
   - Opening a new popup (different trigger) auto-closes the previous one
     by convention: each caller tracks its own "currently open" ref.

   Crucially: outside-click listener uses mousedown (not click) in bubble
   phase. This avoids the race where a click on a sibling trigger closes
   the old popup AND the sibling's click handler tries to open a new one
   but the document listener has already seen the click — with mousedown
   vs click, trigger click handlers still run because they're on click.
   ================================================================== */
(function(){
  console.log("[popup] helper loading...");
  // Track the most recently opened popup so a new call can auto-close it
  let currentPopup = null;
  let currentTrigger = null;
  let currentOnClose = null;
  let mdHandler = null;
  let escHandler = null;

  function closeCurrent() {
    if (!currentPopup) return;
    try { if (currentPopup.parentNode) currentPopup.parentNode.removeChild(currentPopup); } catch(e){}
    try { if (currentOnClose) currentOnClose(); } catch(e){}
    if (mdHandler) document.removeEventListener("mousedown", mdHandler, true);
    if (escHandler) document.removeEventListener("keydown", escHandler, true);
    currentPopup = null;
    currentTrigger = null;
    currentOnClose = null;
    mdHandler = null;
    escHandler = null;
  }

  window.supOpenPopup = function(popupEl, triggerEl, onClose) {
    console.log("[popup] supOpenPopup called", triggerEl);
    // Same trigger clicked → toggle close
    if (currentPopup && currentTrigger === triggerEl) {
      closeCurrent();
      return false; // indicates "closed"
    }
    // Different popup open → close it first
    closeCurrent();

    if (!popupEl.parentNode) document.body.appendChild(popupEl);
    currentPopup = popupEl;
    currentTrigger = triggerEl;
    currentOnClose = onClose || null;
    console.log("[popup] opened, popup el in DOM:", !!popupEl.parentNode, "z-index:", getComputedStyle(popupEl).zIndex);

    // mousedown (not click) — fires before click handlers on other elements,
    // but the check skips if target is inside popup or trigger.
    mdHandler = function(ev) {
      if (!currentPopup) return;
      const insidePopup   = currentPopup.contains(ev.target);
      const insideTrigger = currentTrigger && currentTrigger.contains(ev.target);
      if (!insidePopup && !insideTrigger) closeCurrent();
    };
    escHandler = function(ev) {
      if (ev.key === "Escape") closeCurrent();
    };
    // Defer attach so the mousedown that OPENED this popup doesn't immediately close it
    setTimeout(function(){
      document.addEventListener("mousedown", mdHandler, true);
      document.addEventListener("keydown", escHandler, true);
    }, 0);

    return true; // indicates "opened"
  };

  window.supClosePopup = closeCurrent;
  window.supIsPopupOpen = function(el) { return currentPopup === el; };
  console.log("[popup] helper ready. supOpenPopup defined:", typeof window.supOpenPopup);
})();



/* ==================================================================
   TOAST — simple dark pill that fades in/out at the top center.
   ==================================================================
   Used for "Conversation status changed" etc. Replaces Razvan's request
   in photo 4. Lives in window.supToast so any code can fire it.
   ================================================================== */
(function(){
  let container = null;
  function ensure() {
    if (container) return container;
    container = document.createElement("div");
    container.id = "supToastContainer";
    container.style.cssText = "position:fixed;top:80px;left:50%;transform:translateX(-50%);z-index:10001;display:flex;flex-direction:column;gap:8px;align-items:center;pointer-events:none;";
    document.body.appendChild(container);
    return container;
  }
  window.supToast = function(msg, kind) {
    const c = ensure();
    const t = document.createElement("div");
    t.textContent = String(msg || "");
    t.style.cssText = "background:var(--primary);color:var(--bg);padding:10px 18px;border-radius:10px;font-family:'Geist',sans-serif;font-size:13px;font-weight:500;box-shadow:0 10px 30px rgba(15,23,42,0.25);opacity:0;transform:translateY(-10px);transition:opacity 0.2s, transform 0.2s;pointer-events:auto;";
    if (kind === "error") { t.style.background = "var(--danger)"; }
    if (kind === "success") { t.style.background = "var(--success)"; }
    c.appendChild(t);
    requestAnimationFrame(function(){
      t.style.opacity = "1";
      t.style.transform = "translateY(0)";
    });
    setTimeout(function(){
      t.style.opacity = "0";
      t.style.transform = "translateY(-10px)";
      setTimeout(function(){ try { c.removeChild(t); } catch(e){} }, 250);
    }, 2000);
  };
})();


Requests	IP Address	Location	AS Autonomous System
16	216.24.57.1	United States	AS397273Render
16	192.178.183.95	United States	AS15169Google LLC
16	142.251.14.94	United States	AS15169Google LLC
48	3	-	-

Security Scan Report: studiovel.app

Summary

AI Security Verdict

Confirmed Scam

Risk Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies8

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History