Skip to content

feat: enforce strict content security policy (CSP) - #791

Merged
Nanle-code merged 1 commit into
Nanle-code:masterfrom
Agencybuilds:feature/csp-restrict-final
Jul 29, 2026
Merged

feat: enforce strict content security policy (CSP)#791
Nanle-code merged 1 commit into
Nanle-code:masterfrom
Agencybuilds:feature/csp-restrict-final

Conversation

@Agencybuilds

Copy link
Copy Markdown
Contributor

Closes #773

Objective

Restrict scripts, connections, frames, and fonts while supporting required Stellar and wallet endpoints.

Changes

  • nginx.conf: Added strict Content-Security-Policy header.
  • index.html: Mirrored CSP in meta tag. Used SHA-256 hash for inline theme script.
  • tests/csp.test.js: Added automated tests for primary flow, boundary case, and failure case.
  • SECURITY.md: Updated developer documentation regarding API connections and wallet endpoints.

@vercel

vercel Bot commented Jul 29, 2026

Copy link
Copy Markdown

@Agencybuilds is attempting to deploy a commit to the nanle-code's projects Team on Vercel.

A member of the Team first needs to authorize it.

@drips-wave

drips-wave Bot commented Jul 29, 2026

Copy link
Copy Markdown

@Agencybuilds Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@Nanle-code
Nanle-code merged commit a89d43d into Nanle-code:master Jul 29, 2026
5 of 23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[2026 Security] Ship a restrictive Content Security Policy

2 participants