Web security hardening: headers/CSP, URL scheme guard, tests - #6

Merged

sparkyfen merged 6 commits into

consfyi:mainfrom

sparkyfen:security/web-hardening

Jul 17, 2026

Commits on Jul 14, 2026

web: add security headers (clickjacking + base-uri/object-src)
sparkyfen
committed
415d9c6
web: validate external URL scheme before using as href
sparkyfen
committed
fa9602e
web: enable full CSP via build-time inline-script hashing
sparkyfen
committed
3c41fdb

Commits on Jul 16, 2026

web: add vitest and a safeExternalUrl unit test, run it in CI
sparkyfen
committed
f429fe0
web: gitignore local tooling artifacts (.ship, .wrangler)
sparkyfen
committed
2056737
web: ship strict CSP as report-only for initial rollout
sparkyfen
committed
a57b9f6