Enhance README with security note on postMessage and add allowBack option for item navigation

README.md

@@ -11,7 +11,7 @@ The following parts of the documentation are generated by `Claude-3.7-Sonnet`.
 
 ## Data Transport
 
-The questionnaire component receives input via the `window.postMessage` API. The parent window should post a message with the following structure:
+The questionnaire component receives input via the `window.postMessage` API (see [MDN documentation](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage) for details). The parent window should post a message with the following structure:
 
 ```javascript
 window.postMessage({
@@ -22,6 +22,8 @@ window.postMessage({
 }, '*');
 ```
 
+**Security Note:** When using postMessage in production, always specify an exact target origin instead of '*' to prevent potential cross-site scripting vulnerabilities. The component uses the `settings.origin` property for sending responses back to ensure proper security.
+
 ## Input Schema
 
 ### Root Object
@@ -47,7 +49,8 @@ Each item in the `items` array represents a question with the following structur
   optValues: ['value1', 'value2'], // For 'radio', 'checkbox', 'scale'
   required: true, // Whether answer is required
   minOpts: 1, // For 'checkbox', minimum options to select
-  maxOpts: 3  // For 'checkbox', maximum options to select
+  maxOpts: 3,  // For 'checkbox', maximum options to select
+  allowBack: true // Override global back button setting for this item
 }
 ```
 
@@ -64,6 +67,7 @@ Each item in the `items` array represents a question with the following structur
 | required | boolean | No | Whether an answer is required (default: false) |
 | minOpts | number | No | Minimum options to select for 'checkbox' (default: 1) |
 | maxOpts | number | No | Maximum options to select for 'checkbox' (default: total options) |
+| allowBack | boolean | No | Override global back button setting for this specific item, useful for splitting the survey into sections |
 
 ### Settings Object
 
@@ -73,6 +77,7 @@ Each item in the `items` array represents a question with the following structur
   allowAutoNext: true,   // Auto-advance after selection for radio/scale
   darkMode: false,       // Visual theme
   showItemIndex: true,   // Show item index in the header
+  origin: '*',           // Specify the origin to post messages
   lang: 'en-US'          // Language code
 }
 ```

public/example.json

@@ -11,7 +11,8 @@
             "type": "text",
             "title": "Text",
             "required": true,
-            "desc": "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua."
+            "desc": "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.",
+            "allowBack": false
         },
         {
             "type": "text",

src/App.vue

@@ -77,7 +77,9 @@ export default {
   },
   methods: {
     updateBackButton() {
-      this.uiStatus.backButtonDisabled = !this.settings.allowBack || (this.currentIdx === 0);
+      const itemAllowBack = this.items[this.currentIdx].allowBack === undefined ?
+        this.settings.allowBack : this.items[this.currentIdx].allowBack;
+      this.uiStatus.backButtonDisabled = !itemAllowBack || (this.currentIdx === 0);
     },
     updateNextButton() {
       if (this.currentIdx === this.items.length - 1) {