Finding ID: SEC-027
Location: Global configuration / headers
No Content-Security-Policy header is set globally, leaving the application vulnerable to XSS and related injection attacks.
Impact: Increased risk of script injection and data exfiltration.
Remediation (short): Implement a strict CSP such as: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; and tune for app needs.
Reference: SECURITY_REVIEW.md
Finding ID: SEC-027
Location: Global configuration / headers
No Content-Security-Policy header is set globally, leaving the application vulnerable to XSS and related injection attacks.
Impact: Increased risk of script injection and data exfiltration.
Remediation (short): Implement a strict CSP such as:
default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';and tune for app needs.Reference: SECURITY_REVIEW.md