From d6cfb2e8972e81fb82f1672b69a6acaec913b701 Mon Sep 17 00:00:00 2001 From: clawbot Date: Tue, 10 Mar 2026 03:15:49 -0700 Subject: [PATCH] docs: document CSP header in Security Model section --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 146dad6..2d061a3 100644 --- a/README.md +++ b/README.md @@ -1624,6 +1624,10 @@ authenticity. termination. - **CORS**: The server allows all origins by default (`Access-Control-Allow-Origin: *`). Restrict this in production via reverse proxy configuration if needed. +- **Content-Security-Policy**: The server sets a strict CSP header on all + responses, restricting resource loading to same-origin and disabling + dangerous features (object embeds, framing, base tag injection). The + embedded SPA works without `'unsafe-inline'` for scripts or styles. ---