security: secrets audit + hardened headers (enforced CSP), CodeQL, contact-endpoint hardening - #17

Merged

AdrianLlopart merged 3 commits into

devfrom

claude/security-audit-public-repo-3l282d

Jun 21, 2026

Commits on Jun 21, 2026

security: harden contact endpoint and promotion workflow
claude
committed
security: add HSTS + Permissions-Policy + CSP (report-only), CodeQL scanning
claude
committed
security: enforce CSP (verified in-browser against the real CDN)

AdrianLlopart
and
claude
committed