Follow the v4.0 rules catalogue
The SDTMIG v4.0 change checklist, and a note when a rule in the catalogue changes. It is the same checklist and the same note for everyone on the list — nothing about your studies goes into it, because nothing about your studies reaches us.
Two pages, two different answers
The scanner and this form are deliberately not the same page, and they are not governed by the same policy. It is worth being precise about which one does what, because the difference is the whole reason for the extra click.
The scanner sends nothing, and cannot. It is served with connect-src 'none', so the browser permits it no connection at all — not to a third party, and not back to this domain either. Your Define-XML is parsed in that tab and the report is written in that tab. There is no destination for either to go to, which is a fact you can read off the response headers rather than take on trust.
This page sends one thing, once, when you submit it. A POST to /.netlify/functions/subscribe on this domain, carrying {"email":"…"} and nothing else. It happens because you pressed the button, and it does not happen before then. Open the network panel and watch: nothing goes out while this page is merely open.
Nothing links the two. You arrived here by a link with no query string, from a page that had nothing to put in one. This page has never seen a file name, a study identifier or a result, so the address you type cannot be joined to a scan by us or by anyone we send it to.
The report is not what this is for
Your report is already yours, in the scanner, behind no form: HTML, Markdown, PDF, JSON, or the checklist as an Excel workbook. We never receive it, which is also why we cannot email it to you and do not offer to. This list is the thing beside the report, not a gate in front of it.