🛡️ Sentinel: [improvement] Add Content Security Policy Report-Only header (#86)

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-04-21 22:51:50 +02:00
parent 006ba539ab
commit 431e7c0553
1 changed files with 5 additions and 0 deletions
--- a/next.config.ts
+++ b/next.config.ts
@@ -25,6 +25,11 @@ const nextConfig: NextConfig = {
            value: 'max-age=31536000; includeSubDomains',
          },
          { key: 'X-DNS-Prefetch-Control', value: 'off' },
+          {
+            key: 'Content-Security-Policy-Report-Only',
+            value:
+              "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://*.basemaps.cartocdn.com; font-src 'self'; connect-src 'self';",
+          },
        ],
      },
    ];