From f56a7208ad5cbef79ddc80f8979e7d97bba9de73 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
<161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 11 Jul 2026 04:13:35 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20harden=20CS?=
=?UTF-8?q?P=20and=20security=20headers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
- Tighten Content Security Policy in docs layout (remove unused font origins, set base-uri 'none')
- Add comprehensive security headers to firebase.json for both main site and docs
- Synchronize Vercel Analytics/Insights whitelists across workspace
- Remove ineffective frame-ancestors directive from meta tag (moved to HTTP headers)
---
docs/app/[[...mdxPath]]/layout.tsx | 2 +-
firebase.json | 74 +++++++++++++++++++++++++++++-
2 files changed, 73 insertions(+), 3 deletions(-)
diff --git a/docs/app/[[...mdxPath]]/layout.tsx b/docs/app/[[...mdxPath]]/layout.tsx
index b60765e..19ab875 100644
--- a/docs/app/[[...mdxPath]]/layout.tsx
+++ b/docs/app/[[...mdxPath]]/layout.tsx
@@ -30,7 +30,7 @@ export default async function RootLayout({ children }: { children: ReactNode })
diff --git a/firebase.json b/firebase.json
index ac10c22..133ce47 100644
--- a/firebase.json
+++ b/firebase.json
@@ -9,7 +9,42 @@
"**/node_modules/**"
],
"cleanUrls": true,
- "trailingSlash": false
+ "trailingSlash": false,
+ "headers": [
+ {
+ "source": "/**",
+ "headers": [
+ {
+ "key": "Content-Security-Policy",
+ "value": "default-src 'self'; script-src 'self' 'unsafe-inline' va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' vitals.vercel-insights.com; frame-ancestors 'none'; base-uri 'none'; form-action 'self'; upgrade-insecure-requests;"
+ },
+ {
+ "key": "X-Content-Type-Options",
+ "value": "nosniff"
+ },
+ {
+ "key": "X-Frame-Options",
+ "value": "DENY"
+ },
+ {
+ "key": "X-XSS-Protection",
+ "value": "0"
+ },
+ {
+ "key": "Referrer-Policy",
+ "value": "strict-origin-when-cross-origin"
+ },
+ {
+ "key": "Strict-Transport-Security",
+ "value": "max-age=31536000; includeSubDomains; preload"
+ },
+ {
+ "key": "Permissions-Policy",
+ "value": "camera=(), microphone=(), geolocation=()"
+ }
+ ]
+ }
+ ]
},
{
"target": "docs",
@@ -20,7 +55,42 @@
"**/node_modules/**"
],
"cleanUrls": true,
- "trailingSlash": false
+ "trailingSlash": false,
+ "headers": [
+ {
+ "source": "/**",
+ "headers": [
+ {
+ "key": "Content-Security-Policy",
+ "value": "default-src 'self'; script-src 'self' 'unsafe-inline' va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' vitals.vercel-insights.com; frame-ancestors 'none'; base-uri 'none'; form-action 'self'; upgrade-insecure-requests;"
+ },
+ {
+ "key": "X-Content-Type-Options",
+ "value": "nosniff"
+ },
+ {
+ "key": "X-Frame-Options",
+ "value": "DENY"
+ },
+ {
+ "key": "X-XSS-Protection",
+ "value": "0"
+ },
+ {
+ "key": "Referrer-Policy",
+ "value": "strict-origin-when-cross-origin"
+ },
+ {
+ "key": "Strict-Transport-Security",
+ "value": "max-age=31536000; includeSubDomains; preload"
+ },
+ {
+ "key": "Permissions-Policy",
+ "value": "camera=(), microphone=(), geolocation=()"
+ }
+ ]
+ }
+ ]
}
]
}