cesnimda
38a58871ac
Implements AUDIT_REPORT.md M-2 and M-5: - M-2: CSP (script-src 'self'; frame-ancestors 'none'; object-src 'none'; ...), nosniff, X-Frame-Options DENY, Referrer-Policy on the SPA nginx, plus gzip for the bundle. The inline theme bootstrap moved to /theme-init.js so script-src 'self' holds with no inline scripts. - M-5: vite 5 -> 8 (+ plugin-react 6) — clears the dev-only esbuild advisories; npm audit now reports 0 vulnerabilities including dev deps. Build verified. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
16 lines
530 B
HTML
16 lines
530 B
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<link rel="icon" type="image/svg+xml" href="/favicon.svg" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
|
<title>InboxIntel — Gmail analytics & cleanup</title>
|
|
<!-- Theme applied before first paint; external file so CSP can use script-src 'self'. -->
|
|
<script src="/theme-init.js"></script>
|
|
</head>
|
|
<body>
|
|
<div id="root"></div>
|
|
<script type="module" src="/src/main.jsx"></script>
|
|
</body>
|
|
</html>
|