feat: add production security headers to next.config.ts - #65

Merged

chonilius merged 11 commits into

MergeFi:mainfrom

presidojay1:feat/security-headers

Jul 18, 2026

Commits on Jul 18, 2026

feat(security): add X-Frame-Options: DENY to prevent clickjacking (#50)
presidojay1
committed
2675f0d
feat(security): add X-Content-Type-Options: nosniff (#50)
presidojay1
committed
4935621
feat(security): add Referrer-Policy protecting the OAuth callback token (#50)
presidojay1
committed
c4eed46
feat(security): add conservative Strict-Transport-Security (#50)
presidojay1
committed
84ca19b
test(security): add automated security-header verification script (#50)
presidojay1
committed
3b229c9
chore: add verify:headers npm script (#50)
presidojay1
committed
f3d4586
ci: run security-header verification in the CI pipeline (#50)
presidojay1
committed
b5f4129
test(security): add manual iframe-embedding verification fixture (#50)
presidojay1
committed
c0ca3af
docs: document the security headers policy and rollout plan (#50)
presidojay1
committed
bb614b0
fix(test): fail fast in verify-security-headers.mjs on server crash (#50)
presidojay1
committed
1299345
fix(test): stop verify-security-headers.mjs hanging forever in CI (#50)
presidojay1
committed
60b1cee