feat: add HSTS, CSP, and Permissions-Policy security headers (closes #91) #121

Merged

clawbot merged 2 commits from issue-91-security-headers into next

2026-09-21 20:43:13 +02:00

Author	SHA1	Message	Date
sneak	3afce48383	feat: add HSTS, CSP, and Permissions-Policy security headers (closes #91 ) check / check (push) Successful in 2m48s Details SecurityHeaders() now also sets Strict-Transport-Security, Content-Security-Policy, and Permissions-Policy. HSTS is emitted unconditionally: browsers ignore it over plaintext (RFC 6797 section 8.1), so it never lies about the connection and no forwarded-proto header need be trusted. The CSP baseline is default-src 'self' with frame-ancestors 'none' as the primary clickjacking control. script-src and style-src carry 'unsafe-inline' because the generator template has inline onclick handlers and the bundled Tailwind asset injects a runtime <style> element; removing that need is a template change beyond this issue. Permissions-Policy denies browser features pixa does not use. Model: opus-4-8	2026-09-21 18:16:20 +00:00
sneak	73fc21b6a8	test: assert HSTS, CSP, and Permissions-Policy headers Failing test for the three security headers required before 1.0 (issue #91). Implementation follows in the next commit. Model: opus-4-8	2026-09-21 18:16:20 +00:00

Author

SHA1

Message

Date

sneak

3afce48383

feat: add HSTS, CSP, and Permissions-Policy security headers (closes #91 )

check / check (push) Successful in 2m48s

Details

SecurityHeaders() now also sets Strict-Transport-Security,
Content-Security-Policy, and Permissions-Policy.

HSTS is emitted unconditionally: browsers ignore it over plaintext
(RFC 6797 section 8.1), so it never lies about the connection and no
forwarded-proto header need be trusted.

The CSP baseline is default-src 'self' with frame-ancestors 'none' as
the primary clickjacking control. script-src and style-src carry
'unsafe-inline' because the generator template has inline onclick
handlers and the bundled Tailwind asset injects a runtime <style>
element; removing that need is a template change beyond this issue.

Permissions-Policy denies browser features pixa does not use.

Model: opus-4-8

2026-09-21 18:16:20 +00:00

sneak

73fc21b6a8

test: assert HSTS, CSP, and Permissions-Policy headers

Failing test for the three security headers required before 1.0
(issue #91). Implementation follows in the next commit.

Model: opus-4-8

2026-09-21 18:16:20 +00:00