cesnimda 38a58871ac fix(security): audit batch B — SPA CSP/security headers + vite upgrade ...

Implements AUDIT_REPORT.md M-2 and M-5:
- M-2: CSP (script-src 'self'; frame-ancestors 'none'; object-src 'none'; ...),
  nosniff, X-Frame-Options DENY, Referrer-Policy on the SPA nginx, plus gzip for
  the bundle. The inline theme bootstrap moved to /theme-init.js so script-src
  'self' holds with no inline scripts.
- M-5: vite 5 -> 8 (+ plugin-react 6) — clears the dev-only esbuild advisories;
  npm audit now reports 0 vulnerabilities including dev deps. Build verified.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-02 03:21:35 +02:00

..

public

fix(security): audit batch B — SPA CSP/security headers + vite upgrade

2026-07-02 03:21:35 +02:00

src

feat(search): why this matched highlights (#15)

2026-07-01 22:22:38 +02:00

.env.example

chore: init project

2026-06-30 15:53:32 +02:00

Dockerfile

chore: init project

2026-06-30 15:53:32 +02:00

index.html

fix(security): audit batch B — SPA CSP/security headers + vite upgrade

2026-07-02 03:21:35 +02:00

nginx.conf

fix(security): audit batch B — SPA CSP/security headers + vite upgrade

2026-07-02 03:21:35 +02:00

package-lock.json

fix(security): audit batch B — SPA CSP/security headers + vite upgrade

2026-07-02 03:21:35 +02:00

package.json

fix(security): audit batch B — SPA CSP/security headers + vite upgrade

2026-07-02 03:21:35 +02:00

postcss.config.js

feat(ui): F0 — Tailwind + design tokens + theme infrastructure

2026-06-30 23:11:51 +02:00

tailwind.config.js

feat(ui): Inter + design-system preview page (#10)

2026-07-01 20:14:51 +02:00

vite.config.js

chore: init project

2026-06-30 15:53:32 +02:00