add-sponsor

name	add-sponsor
description	Add, move or remove a sponsor logo in the README and on the install page. Use when a GitHub sponsor reaches the Team or Company tier, when a sponsorship lapses, or when a sponsor sends a new logo asset.

Adding a sponsor

Assets live in docs/sponsors/<name>.svg. Three edits, all by hand — there is no CI.

README — one block under the install badge, holding both tiers

Company first, Team after, the same height="28" for every logo, and no taglines (they force a vertical layout and push the project's own pitch off the screen). The label links to the Support section so the policy is one click away:

<p align="center">
  <sub><b><a href="#support-this-project">Supported by</a></b></sub><br>
  <a href="https://acme.example" rel="sponsored noopener"><img src="docs/sponsors/acme.svg" alt="Acme" height="28"></a>
  &nbsp;
  <a href="https://globex.example" rel="sponsored noopener"><img src="docs/sponsors/globex.svg" alt="Globex" height="28"></a>
</p>

Do not add a "still MIT / still private" line beside the logos. Both claims are already in the README's first sentence, above the badge.

Install page — Company tier only

A row in the footer of docs/index.html. The footer is also where the update notice sends returning users (d.onclick = window.open(P) in the shim), which is what the tier sells.

<span class="sponsors"><span class="lbl">Supported by</span>
  <a href="https://acme.example" target="_blank" rel="sponsored noopener"><img src="sponsors/acme.svg" alt="Acme" height="28"></a>
</span>

footer .sponsors { display: flex; align-items: center; gap: .5rem .9rem; flex-wrap: wrap; }
footer .sponsors .lbl { font-size: .8rem; color: var(--muted); }
footer .sponsors img { height: 28px; width: auto; max-width: 110px; opacity: .85; }
footer .sponsors a:hover img { opacity: 1; }

Accepting the asset — sanitise before committing

Committing the logo is the right call: it keeps the install page's promise that it makes no third-party requests. Hot-linking a sponsor's own domain would let them log every visitor's IP. (refined-github does the same; larger projects instead serve from their funding platform. Nobody loads a sponsor's server.)

But an SVG is executable XML, so treat every incoming file as untrusted. Rendered through <img> the browser disables scripts and external fetches — however the file stays reachable at its own URL on agarwalvishal.github.io, and opening it directly executes it in that origin. A malicious SVG committed here is stored XSS on the Pages site.

Before committing, open the file and strip:

• <script> elements and any on* attributes (onload, onclick, …)
• <foreignObject>, and any javascript: URI
• external references — <image href="https://…">, <use href>, @import in a <style>. These also silently re-introduce the third-party request the same-origin rule exists to prevent.

An SVG that needs any of the above is not a logo. Ask for a plain one, or a PNG.

Keep the pull request or email that supplied the asset — that is the record of permission to use the mark, and the sponsor's brand guidelines usually ride along with it. Scale it, never recolour or crop it.

Rules

• Team gets the README block; Company gets first position in it plus the install-page footer. Placement follows the amount, at the thresholds published on the Sponsors profile.
• Cap: one row, four logos. A fifth becomes "and N others" linking to the README rather than shrinking the row or wrapping to a second line.
• Order: tier first, then sponsorship start date — deterministic, so no sponsor is hand-picked and any of them can predict where they land.
• height="28" inline and in CSS, so the row does not reflow while the SVG loads.
• Remove ~30 days after a sponsorship lapses — a logo implies a current relationship.
• Logos stay visually subordinate to the not-affiliated-with-Anthropic disclaimer, and a logo may be declined if it would imply Anthropic endorsement.

Verify

1. git diff main -- claude-chat-exporter.js is empty — funding work never touches the script.
2. grep -oE 'https?://[a-zA-Z0-9.-]+' docs/index.html lists no new host: assets are committed and served same-origin, never hot-linked.
3. Every sponsor link carries rel="sponsored noopener".
4. Render the install page locally and check the footer row at 360px, light and dark.