From 13af7700a63605922b366ec47b16e4e4d5973534 Mon Sep 17 00:00:00 2001
From: viccoder-oops <victorignatius2@gmail.com>
Date: Thu, 6 Aug 2026 14:03:56 +0100
Subject: [PATCH] security: add Content-Security-Policy and hardening headers

---
 next.config.js | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/next.config.js b/next.config.js
index a843cbe..b3c676e 100644
--- a/next.config.js
+++ b/next.config.js
@@ -1,6 +1,46 @@
 /** @type {import('next').NextConfig} */
+
+const securityHeaders = [
+  {
+    key: 'Content-Security-Policy',
+    value: [
+      "default-src 'self'",
+      "script-src 'self' 'unsafe-eval' 'unsafe-inline'",
+      "style-src 'self' 'unsafe-inline'",
+      "img-src 'self' data: blob:",
+      "font-src 'self'",
+      "connect-src 'self' https://soroban-testnet.stellar.org https://soroban-rpc.stellar.org https://horizon-testnet.stellar.org https://horizon.stellar.org",
+      "frame-ancestors 'none'",
+    ].join('; '),
+  },
+  {
+    key: 'X-Frame-Options',
+    value: 'DENY',
+  },
+  {
+    key: 'X-Content-Type-Options',
+    value: 'nosniff',
+  },
+  {
+    key: 'Referrer-Policy',
+    value: 'strict-origin-when-cross-origin',
+  },
+  {
+    key: 'Permissions-Policy',
+    value: 'camera=(), microphone=(), geolocation=()',
+  },
+]
+
 const nextConfig = {
   reactStrictMode: true,
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: securityHeaders,
+      },
+    ]
+  },
 }
 
 module.exports = nextConfig