sneak
3afce48383
check / check (push) Successful in 2m48s
SecurityHeaders() now also sets Strict-Transport-Security, Content-Security-Policy, and Permissions-Policy. HSTS is emitted unconditionally: browsers ignore it over plaintext (RFC 6797 section 8.1), so it never lies about the connection and no forwarded-proto header need be trusted. The CSP baseline is default-src 'self' with frame-ancestors 'none' as the primary clickjacking control. script-src and style-src carry 'unsafe-inline' because the generator template has inline onclick handlers and the bundled Tailwind asset injects a runtime <style> element; removing that need is a template change beyond this issue. Permissions-Policy denies browser features pixa does not use. Model: opus-4-8