diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..5e48b43
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2024-05-20 - WebView XSS Prevention
+**Vulnerability:** String interpolation used in `injectJavaScript` to pass data to a WebView, allowing potential Cross-Site Scripting (XSS).
+**Learning:** Even with stringified JSON, `injectJavaScript` executes the result directly in the context of the page, potentially allowing attackers to execute arbitrary JavaScript if the input contains malicious escape sequences.
+**Prevention:** Use `webViewRef.current.postMessage(data)` and listen for the `message` event inside the WebView (`window.addEventListener('message', ...)`).
diff --git a/src/screens/HomeScreen.tsx b/src/screens/HomeScreen.tsx
index 8475bcb..e841fee 100644
--- a/src/screens/HomeScreen.tsx
+++ b/src/screens/HomeScreen.tsx
@@ -42,6 +42,22 @@ const weatherMap: Record<number, { text: string; icon: string }> = {
 const engineHtml = `<!DOCTYPE html><html lang="it"><head>
 <script src="https://cdn.jsdelivr.net/npm/tesseract.js@5/dist/tesseract.min.js"></script></head>
 <body style="background-color:transparent;"><script>
+window.addEventListener("message", function(event) {
+  try {
+    var data = JSON.parse(event.data);
+    if(data.type === 'runTesseract') {
+      window.runTesseract(data.payload);
+    }
+  } catch(e) {}
+});
+document.addEventListener("message", function(event) {
+  try {
+    var data = JSON.parse(event.data);
+    if(data.type === 'runTesseract') {
+      window.runTesseract(data.payload);
+    }
+  } catch(e) {}
+});
 window.runTesseract = async function(base64JsonStr) {
   try {
     const images = JSON.parse(base64JsonStr);
@@ -287,15 +303,7 @@ export default function HomeScreen() {
         setProcessing(true); setOcrText('');
         const base64List = result.assets.map(a => `data:image/jpeg;base64,${a.base64}`);
         const base64Json = JSON.stringify(base64List);
-        // Use postMessage pattern to avoid script-injection risks with injectJavaScript
-        webViewRef.current?.injectJavaScript(`
-          if(window.runTesseract){
-            window.runTesseract(${JSON.stringify(base64Json)});
-          } else {
-            window.ReactNativeWebView.postMessage(JSON.stringify({success:false,error:'OCR non pronto'}));
-          }
-          true;
-        `);
+        webViewRef.current?.postMessage(JSON.stringify({ type: 'runTesseract', payload: base64Json }));
       }
     } catch (e) { if (__DEV__) console.error('[imagePicker]', e); setProcessing(false); }
   };
diff --git a/src/screens/ShiftScreen.tsx b/src/screens/ShiftScreen.tsx
index e04f2fb..7c980e8 100644
--- a/src/screens/ShiftScreen.tsx
+++ b/src/screens/ShiftScreen.tsx
@@ -31,17 +31,9 @@ export default function ShiftScreen() {
         setOcrText('');
         
         const base64List = result.assets.map(a => `data:image/jpeg;base64,${a.base64}`);
-        const base64Json = JSON.stringify(base64List).replace(/'/g, "\\'");
+        const base64Json = JSON.stringify(base64List);
         
-        const jsCode = `
-          if (window.runTesseract) {
-            window.runTesseract('${base64Json}');
-          } else {
-            window.ReactNativeWebView.postMessage(JSON.stringify({ success: false, error: "Motore OCR non pronto." }));
-          }
-          true;
-        `;
-        webViewRef.current?.injectJavaScript(jsCode);
+        webViewRef.current?.postMessage(JSON.stringify({ type: 'runTesseract', payload: base64Json }));
       }
     } catch (e) {
       Alert.alert("Errore OCR", "Impossibile elaborare l'immagine.");
@@ -216,6 +208,22 @@ export default function ShiftScreen() {
     </head>
     <body style="background-color: transparent;">
       <script>
+        window.addEventListener("message", function(event) {
+          try {
+            var data = JSON.parse(event.data);
+            if(data.type === 'runTesseract') {
+              window.runTesseract(data.payload);
+            }
+          } catch(e) {}
+        });
+        document.addEventListener("message", function(event) {
+          try {
+            var data = JSON.parse(event.data);
+            if(data.type === 'runTesseract') {
+              window.runTesseract(data.payload);
+            }
+          } catch(e) {}
+        });
         window.runTesseract = async function(base64JsonStr) {
           try {
             const images = JSON.parse(base64JsonStr);
