Split from #34 (MED).
No CSP, X-Frame-Options, or Referrer-Policy on rendered pages. Rendering is safely escaped today so this is defense-in-depth.
Suggested: default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'; Referrer-Policy: no-referrer
Pentest (#67) confirms the missing headers on this deployment. Note: the HSTS and Host-header-reflecting HTTP->HTTPS redirect parts of #67 are Traefik/infra-level, not app-level - handle those in the Traefik config (redirect middleware + HSTS header on websecure entrypoint), separately from this app middleware. #67 remains open for that piece.
Pentest (#67) confirms the missing headers on this deployment. Note: the HSTS and Host-header-reflecting HTTP->HTTPS redirect parts of #67 are Traefik/infra-level, not app-level - handle those in the Traefik config (redirect middleware + HSTS header on websecure entrypoint), separately from this app middleware. #67 remains open for that piece.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Split from #34 (MED).
No CSP, X-Frame-Options, or Referrer-Policy on rendered pages. Rendering is safely escaped today so this is defense-in-depth.
Suggested: default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'; Referrer-Policy: no-referrer
Pentest (#67) confirms the missing headers on this deployment. Note: the HSTS and Host-header-reflecting HTTP->HTTPS redirect parts of #67 are Traefik/infra-level, not app-level - handle those in the Traefik config (redirect middleware + HSTS header on websecure entrypoint), separately from this app middleware. #67 remains open for that piece.