From b31b07fc22d36f907733bbbc8b2e89d8728fc3e8 Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Mon, 2 Nov 2026 09:29:53 +0000 Subject: [PATCH] CSP: allow the universal footer's icons and logo img-src was 'self' data:, which blocked the built.indie and PwaMart icons and the Profullstack logo in the shared footer. Co-Authored-By: Claude Opus 5.5 --- src/server.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/server.ts b/src/server.ts index 196c424..41397cd 100644 --- a/src/server.ts +++ b/src/server.ts @@ -26,7 +26,7 @@ export const PUBLIC_ORIGIN = 'https://auto.hacker.pit.world' const CSP = [ "default-src 'none'", "style-src 'self' 'unsafe-inline'", "script-src 'self' 'unsafe-inline' https://crawlproof.com", - "img-src 'self' data:", "connect-src 'self' https://crawlproof.com", "manifest-src 'self'", "worker-src 'self'", + "img-src 'self' data: https://built.indie.pit.world https://pwamart.com https://profullstack.com", "connect-src 'self' https://crawlproof.com", "manifest-src 'self'", "worker-src 'self'", "form-action 'self' https://coinpayportal.com", "base-uri 'none'", "frame-ancestors 'none'", ].join('; ') const SECURITY_HEADERS: Record = {