Skip to content

fix: add security headers to Vercel deployment#439

Merged
koala73 merged 1 commit intomainfrom
fix/security-headers
Feb 26, 2026
Merged

fix: add security headers to Vercel deployment#439
koala73 merged 1 commit intomainfrom
fix/security-headers

Conversation

@koala73
Copy link
Owner

@koala73 koala73 commented Feb 26, 2026

Summary

  • Adds 6 security headers to all routes via vercel.json catch-all pattern
  • X-Content-Type-Options: nosniff
  • X-Frame-Options: SAMEORIGIN
  • Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  • Content-Security-Policy (mirrors index.html meta + frame-ancestors, base-uri, object-src, form-action)
  • Referrer-Policy: strict-origin-when-cross-origin
  • Permissions-Policy: camera=(), microphone=(), geolocation=()

Test plan

  • Deploy preview and scan with securityheaders.com
  • Verify YouTube embed still loads in iframe (SAMEORIGIN allows it)
  • Verify PostHog ingest proxy still works (connect-src allows https:)

Add X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security,
Content-Security-Policy, Referrer-Policy, and Permissions-Policy headers
to all routes via vercel.json catch-all pattern.
@chatgpt-codex-connector
Copy link

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@vercel
Copy link

vercel bot commented Feb 26, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
worldmonitor Building Building Preview, Comment Feb 26, 2026 6:34pm
worldmonitor-finance Building Building Preview, Comment Feb 26, 2026 6:34pm
worldmonitor-happy Building Building Preview, Comment Feb 26, 2026 6:34pm
worldmonitor-startup Building Building Preview, Comment Feb 26, 2026 6:34pm

Request Review

@koala73 koala73 merged commit 8b7c2e8 into main Feb 26, 2026
6 checks passed
facusturla pushed a commit to facusturla/worldmonitor that referenced this pull request Feb 27, 2026
Add X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security,
Content-Security-Policy, Referrer-Policy, and Permissions-Policy headers
to all routes via vercel.json catch-all pattern.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant