shadowdao 5896ec0893 security(web): enforce anti-clickjacking via response headers ...

frame-ancestors is ignored inside a <meta> CSP, so move clickjacking
protection to real response headers (X-Frame-Options: DENY) and add
X-Content-Type-Options: nosniff and Referrer-Policy: no-referrer on all
responses. Drop the ineffective frame-ancestors token from the meta CSP.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-17 10:37:25 -07:00

..

css

design(web): "Tactile Deck" redesign with light/dark theming

2026-07-17 10:32:04 -07:00

icons

Modernize application to v0.9.0 with PySide6, FastAPI, and PWA support

2026-01-03 16:57:14 -08:00

js

security+feat(web): kill DOM XSS, add CSP, in-browser macro editor

2026-07-17 10:24:14 -07:00

index.html

security(web): enforce anti-clickjacking via response headers

2026-07-17 10:37:25 -07:00

manifest.json

design(web): "Tactile Deck" redesign with light/dark theming

2026-07-17 10:32:04 -07:00

service-worker.js

security+feat(web): kill DOM XSS, add CSP, in-browser macro editor

2026-07-17 10:24:14 -07:00