palette-agent e08cafe9c8 security headers middleware: CSP, Referrer-Policy, nosniff on HTML pages (#59) ...

- web.SecurityHeaders middleware wired into the chi router
- Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' (page scripts are inline); frame-ancestors 'none'
- Referrer-Policy: no-referrer, X-Content-Type-Options: nosniff
- Applied only to text/html responses; JSON API and /raw pass through unchanged
- Regression test internal/web/securityheaders_test.go

2026-09-09 09:16:42 -05:00

..

api

security headers middleware: CSP, Referrer-Policy, nosniff on HTML pages (#59)

2026-09-09 09:16:42 -05:00

lang

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

store

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

web

security headers middleware: CSP, Referrer-Policy, nosniff on HTML pages (#59)

2026-09-09 09:16:42 -05:00