Add HTTP security headers to API responses and static assets

A security audit found no security headers (CSP, X-Frame-Options,
X-Content-Type-Options, etc.) set anywhere in the deployment.

- backend/app/main.py: an ASGI middleware sets X-Content-Type-Options,
  X-Frame-Options, Referrer-Policy, and a path-scoped
  Content-Security-Policy (strict for JSON API endpoints, a looser
  CDN/inline-allowing policy for FastAPI's stock /docs and /redoc pages,
  and a frontend-matching one for the local-dev static-file fallback) on
  every response. Strict-Transport-Security is added only when
  SESSION_COOKIE_SECURE is true, so plain-http local dev is unaffected.
  Verified live against a local uvicorn instance (curl -I on /health,
  /api/v1/opportunities/stats, /openapi.json, /docs, /redoc, /) and with
  Playwright against /docs and /redoc confirming no CSP-refusal console
  errors for their CDN scripts/styles or Swagger's inline init script.

- frontend/_headers: Cloudflare Workers' native static-asset header
  mechanism (confirmed current via the Cloudflare docs MCP tool, not
  assumed) attaches the same header set at the edge, since the Worker
  script never runs for matching static files. CSP is scoped per page:
  index.html allows Google Fonts and its one inline JSON-LD block via a
  sha256 hash (no unsafe-inline needed for script-src); admin.html has no
  inline scripts at all. Verified against a real `wrangler dev` locally,
  including a redirect gotcha it surfaced: /admin.html 307s to the
  extensionless /admin, so that canonical path needed its own rule too.

- docs/DEPLOY-CLOUDFLARE-WORKERS.md: documents both mechanisms and why
  they're split across two files with no shared config to read from.

Full backend pytest suite (316 tests), ruff, and the frontend vitest
suite (27 tests) all pass unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019Umy9bW14TMbzW2QD7eLt3

Author: claude

backend/app/main.py

@@ -68,6 +68,98 @@ async def lifespan(app: FastAPI):
     allow_headers=["*"],
 )
 
+# ---- Security headers (2026-08 audit: none were set anywhere) --------
+# Applied to every response via middleware rather than per-route, so a
+# new route can never ship without them by omission.
+#
+# The Content-Security-Policy is path-scoped because this app genuinely
+# serves three different kinds of response:
+#   - JSON API endpoints (/api/*, /health, /openapi.json) render no page
+#     at all, so they get the strictest possible policy.
+#   - /docs and /redoc are FastAPI's built-in Swagger UI / ReDoc pages.
+#     Verified by actually curling both: Swagger UI loads its JS/CSS
+#     from cdn.jsdelivr.net and runs an inline init `<script>`; ReDoc
+#     loads its bundle from the same CDN plus a Google Font and injects
+#     inline `<style>` at runtime (its CSS-in-JS). A strict policy blanks
+#     both pages out, so they get a scoped, looser policy instead of
+#     weakening the default for everything else.
+#   - Everything else falls through to `frontend()` below, which only
+#     serves the static site directly when this app is run without the
+#     Cloudflare Worker in front of it (local dev, `docker compose`, or
+#     a direct hit on the Render origin). Its policy mirrors
+#     `frontend/_headers`, which is what actually applies in production
+#     — Cloudflare serves those files at the edge without this app in
+#     the loop at all.
+_DOCS_PATHS = {"/docs", "/docs/oauth2-redirect", "/redoc"}
+_API_EXACT_PATHS = {"/health", "/openapi.json", "/api"}
+_API_PREFIX = "/api/"
+
+# unsafe-inline is unavoidable here without vendoring/patching FastAPI's
+# built-in docs HTML to add a nonce: Swagger's init script is generated
+# fresh per request and ReDoc injects styles at runtime, so neither a
+# static hash nor a nonce (no per-request templating happens for these
+# stock responses) is workable. Scoped to just these two paths so it
+# never leaks into the API or frontend policies below.
+_DOCS_CSP = (
+    "default-src 'self'; "
+    "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
+    "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; "
+    "font-src https://fonts.gstatic.com; "
+    "img-src 'self' data: https://fastapi.tiangolo.com; "
+    "connect-src 'self'; "
+    "base-uri 'self'; "
+    "object-src 'none'"
+)
+
+# JSON responses need nothing at all.
+_API_CSP = "default-src 'none'; base-uri 'none'"
+
+# Mirrors frontend/_headers — see the comment there for why each source
+# is listed (Google Fonts, and a hash for index.html's inline JSON-LD
+# block). Duplicated rather than shared because the Worker and this app
+# are separate runtimes with no shared config to read from.
+_FRONTEND_CSP = (
+    "default-src 'self'; "
+    "script-src 'self' 'sha256-pDG7ywLQCTavmocE0AIF4eN7Dq/Ibx1SKkzQ6wMOiBg='; "
+    "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
+    "font-src https://fonts.gstatic.com; "
+    "img-src 'self' data:; "
+    "connect-src 'self'; "
+    "base-uri 'self'; "
+    "form-action 'self'; "
+    "object-src 'none'"
+)
+
+
+def _csp_for_path(path: str) -> str:
+    if path in _DOCS_PATHS:
+        return _DOCS_CSP
+    if path in _API_EXACT_PATHS or path.startswith(_API_PREFIX):
+        return _API_CSP
+    return _FRONTEND_CSP
+
+
+@app.middleware("http")
+async def add_security_headers(request, call_next):
+    response = await call_next(request)
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    # DENY instead of a CSP `frame-ancestors` directive — they express
+    # the same "never frame this" rule and the task is to pick one, not
+    # maintain both in lockstep.
+    response.headers["X-Frame-Options"] = "DENY"
+    response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+    response.headers["Content-Security-Policy"] = _csp_for_path(request.url.path)
+    # HSTS is only safe once the app is actually reachable over HTTPS.
+    # SESSION_COOKIE_SECURE=false is the existing flag for "this is
+    # plain-http local dev" (see app/config.py) — reused here rather
+    # than adding a second flag, so local dev never gets an HSTS header
+    # a plain-http server couldn't honour anyway.
+    if settings.SESSION_COOKIE_SECURE:
+        response.headers["Strict-Transport-Security"] = (
+            "max-age=63072000; includeSubDomains; preload"
+        )
+    return response
+
 app.include_router(opportunities.router, prefix="/api/v1")
 app.include_router(scraper.router, prefix="/api/v1")
 app.include_router(subscribers.router, prefix="/api/v1")

docs/DEPLOY-CLOUDFLARE-WORKERS.md

@@ -91,6 +91,35 @@ point of view it's still one origin — **zero changes to cookies,
   the moderation queue loads (this is the real test of the cookie/CORS
   behavior above)
 
+## HTTP security headers
+
+A 2026-08 audit found no security headers (CSP, `X-Frame-Options`,
+`X-Content-Type-Options`, etc.) being sent anywhere. Two separate places
+needed them, since the two halves of this deployment never share a runtime:
+
+- **The API/docs, proxied to Render** — `backend/app/main.py` has an ASGI
+  middleware (`add_security_headers`) that sets them on every response, with
+  a path-scoped `Content-Security-Policy`: strict for JSON endpoints, a
+  looser CDN/inline-allowing one for `/docs` and `/redoc` (FastAPI's stock
+  Swagger UI / ReDoc pages), and one matching the frontend's below for the
+  local-dev fallback where this same app serves `frontend/` directly.
+- **The static site, edge-served** — `frontend/_headers` (Cloudflare's
+  native mechanism for this — see
+  [Headers](https://developers.cloudflare.com/workers/static-assets/headers/) —
+  confirmed via the Cloudflare docs MCP tool rather than assumed, since it
+  supersedes the old Pages-only convention; no `run_worker_first` needed
+  since nothing here has to run per-request). Verified against a real
+  `wrangler dev` locally, including a gotcha the docs don't call out: hitting
+  `/admin.html` 307-redirects to the extensionless `/admin`, so the CSP rule
+  has to target `/admin` too or the page that actually gets served carries
+  no policy at all.
+
+`Strict-Transport-Security` is unconditional in `_headers` (Cloudflare only
+serves this site over HTTPS) but conditional in the backend middleware on
+`settings.SESSION_COOKIE_SECURE` — the existing flag for "this is plain-http
+local dev" — so local development never gets an HSTS header a plain-http
+server can't honour.
+
 ## What does *not* change
 
 - The Render service keeps running exactly as-is — same Docker image, same

frontend/_headers

@@ -0,0 +1,58 @@
+# HTTP security headers for the static site (2026-08 audit: none were set
+# anywhere). Parsed by Cloudflare Workers static assets at the edge — see
+# https://developers.cloudflare.com/workers/static-assets/headers/ — and
+# applied to every file in this directory without the Worker script (worker/
+# index.js) ever running, matching how it already documents asset serving.
+#
+# Two things to know about this file's matching rules before editing it:
+#   - When more than one block matches a URL, ALL of them apply; if the same
+#     header name appears in more than one matching block, Cloudflare joins
+#     the values with a comma instead of picking one. That's harmless for
+#     most headers but would silently produce an invalid, unenforceable
+#     Content-Security-Policy (commas aren't a valid directive separator —
+#     only `;` is), so CSP is deliberately set in exactly one block per URL:
+#     the page-specific ones below, never the `/*` baseline.
+#   - Rules match the request path, not the resolved file, so both `/` and
+#     `/index.html` need their own block even though they serve the same file
+#     — and admin.html needs THREE: Cloudflare's default html_handling
+#     redirects both `/admin` and `/admin.html` requests to a canonical URL,
+#     but which one is canonical differs by request — checked against a
+#     local `wrangler dev`: `/admin.html` -> 307 -> `/admin`, so `/admin` (no
+#     extension) is what a browser actually lands on and needs the policy,
+#     not just `/admin.html`.
+
+# Baseline for every response: css/js/robots.txt/sitemap.xml/config.js, and
+# every page below inherits these too since no page block repeats them.
+/*
+  X-Content-Type-Options: nosniff
+  X-Frame-Options: DENY
+  Referrer-Policy: strict-origin-when-cross-origin
+  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
+
+# index.html — same policy at both paths Cloudflare will actually receive
+# requests for. Only loads Google Fonts (fonts.googleapis.com/fonts.gstatic.com)
+# and one inline script: the `application/ld+json` SEO structured-data block.
+# JSON-LD can't be a separate file (crawlers expect it inline) and this static
+# file has no per-request templating to hang a nonce on, so it's allowlisted
+# by exact content hash instead of 'unsafe-inline' — the narrowest option that
+# still works for a fully static page. If that <script> block's content ever
+# changes, recompute the hash or the browser will silently drop the block:
+#   python3 -c "import hashlib,base64,re; h=open('index.html',encoding='utf-8').read(); m=re.search(r'<script type=\"application/ld\+json\">\n(.*?)</script>', h, re.S); print('sha256-' + base64.b64encode(hashlib.sha256(m.group(1).encode()).digest()).decode())"
+# style-src needs 'unsafe-inline' for the many style="..." attributes on
+# individual elements (checked: no <style> block or .cssText/style-string
+# writes in app.js, just per-property assignments, which CSP style-src
+# doesn't govern anyway — but the attributes do).
+/
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'sha256-pDG7ywLQCTavmocE0AIF4eN7Dq/Ibx1SKkzQ6wMOiBg='; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; base-uri 'self'; form-action 'self'; object-src 'none'
+
+/index.html
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'sha256-pDG7ywLQCTavmocE0AIF4eN7Dq/Ibx1SKkzQ6wMOiBg='; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; base-uri 'self'; form-action 'self'; object-src 'none'
+
+# admin.html — same needs minus the JSON-LD block (it has none: config.js and
+# js/admin.js are both external <script src>, no inline script anywhere), so
+# script-src stays 'self' with no hash/unsafe-inline needed at all.
+/admin.html
+  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; base-uri 'self'; form-action 'self'; object-src 'none'
+
+/admin
+  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; base-uri 'self'; form-action 'self'; object-src 'none'