[Security] Hand-rolled security headers omit Content-Security-Policy, COOP and CORP; /api-docs serves HTML with no CSP

[grantfox-oss]

Telegram (ask questions / claim the issue here first): https://t.me/+DOylgFv1jyJlNzM0

Why this matters

backend/src/app.ts:35-46 hand-sets a helmet-equivalent header set but omits Content-Security-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy. Swagger UI is mounted at /api-docs and returns HTML, so the absence of a CSP leaves that page without script/style restrictions.

Acceptance criteria

• Add Content-Security-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy (or replace the hand-rolled block with helmet)
• Ensure the Swagger UI page still loads under the chosen CSP
• Keep HSTS gated on production as today

Files to touch

• backend/src/app.ts

Out of scope

• Rate limiting / CORS changes

[onyemaechiezekiel9]

@onyemaechiezekiel9 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello, I have gone through the issue and I would love to work on this swiftly

ℹ️ Repo Maintainers: To accept this application, review their application or assign @onyemaechiezekiel9 to this issue.

[oscar24357]

@oscar24357 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello maintainer, I'd like to work on this issue, can you please assign me to it?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @oscar24357 to this issue.

[akinboyewaSamson]

@akinboyewaSamson has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello,

I’m a smart contract and full-stack developer interested in contributing to this issue. My technical background includes Rust, Soroban, Cairo, Solidity, and TypeScript, with a focus on building secure, scalable, and maintainable blockchain applications.

Based on the scope of this issue, I’m confident I can deliver a complete and well-tested solution within 10hours of assignment. I prioritize clean code, clear documentation, and efficient implementation.

I’d appreciate the opportunity to contribute and help move this issue forward.

Thank you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @akinboyewaSamson to this issue.

[Oluwasuyi-Timilehin]

@Oluwasuyi-Timilehin has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello maintainer, please assign me to this task. i would get started immediately
ETA 1hour

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Oluwasuyi-Timilehin to this issue.

[Drock0]

@Drock0 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi! I'd like to work on this issue if it's still available.

I have experience with the tech stack involved and can deliver a well-tested solution. Please assign it to me. Thanks!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Drock0 to this issue.

[grantfox-oss]

🦊 GrantFox — @Drock0 has been assigned to this issue!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #821)
2. Your PR will be reviewed by the LabsCrypt maintainers

Good luck! Track your progress on GrantFox.

[drips-wave]

Congratulations, @Drock0! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @Drock0: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox!

@Drock0's PR #966 was approved and merged by @ogazboiz.

🏆 @Drock0: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (153 total points). Track your full progress on GrantFox.

👏 Great work, @Drock0! Keep contributing to LabsCrypt.