mirror of
https://github.com/priyanshujain/margin.git
synced 2026-10-02 19:17:03 +00:00
security.csp was null (no CSP). Add a restrictive policy as defense-in-depth: self-only by default, data:/blob: images for cover and figure URLs, inline styles for React/inline style attributes, and blob: workers for pdf.js. Needs verification against a production build (covers, preview, export, IPC). Claude-Session: https://claude.ai/code/session_01RzTWrLiy4zGuw2hZSQGamk