From e0484354b975ef9af7e25679a393c2a7aa6d9c68 Mon Sep 17 00:00:00 2001
From: Christian Vidal Wolf <christianvidalwolf@gmail.com>
Date: Thu, 23 Apr 2026 10:04:33 +0200
Subject: [PATCH] Security: Add HTTP security headers via vercel.json

Adds HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy,
and Permissions-Policy to all responses. CSP allowlist includes only
Supabase and Dropbox as external connect targets.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 vercel.json | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/vercel.json b/vercel.json
index 72d37c2..841f31d 100644
--- a/vercel.json
+++ b/vercel.json
@@ -2,5 +2,40 @@
   "rewrites": [
     { "source": "/api/dropbox-proxy", "destination": "api/dropbox-proxy.js" },
     { "source": "/api/dropbox-sync", "destination": "api/dropbox-sync.js" }
+  ],
+  "headers": [
+    {
+      "source": "/(.*)",
+      "headers": [
+        {
+          "key": "X-Content-Type-Options",
+          "value": "nosniff"
+        },
+        {
+          "key": "X-Frame-Options",
+          "value": "DENY"
+        },
+        {
+          "key": "X-XSS-Protection",
+          "value": "1; mode=block"
+        },
+        {
+          "key": "Referrer-Policy",
+          "value": "strict-origin-when-cross-origin"
+        },
+        {
+          "key": "Permissions-Policy",
+          "value": "camera=(), microphone=(), geolocation=()"
+        },
+        {
+          "key": "Strict-Transport-Security",
+          "value": "max-age=63072000; includeSubDomains; preload"
+        },
+        {
+          "key": "Content-Security-Policy",
+          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' https://hwithddwaapyhnfwcesj.supabase.co https://api.dropboxapi.com https://www.dropbox.com; font-src 'self'; frame-ancestors 'none';"
+        }
+      ]
+    }
   ]
 }