1 Commits

Author	SHA1	Message	Date
LinYushen	e20c507dcc	fix(security): add Content-Security-Policy response header (#822) ... Adds CSP middleware to the global middleware chain as a browser-level defense against XSS: script-src 'self', object-src 'none', frame-ancestors 'none', base-uri 'self', form-action 'self'. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-13 12:53:39 +08:00