5 Commits

Include renames

Author	SHA1	Message	Date
Linus Rath	1fd5d0558c	fix: send HSTS on TLS requests and drop the X-Powered-By header	2026-10-19 01:32:27 +02:00
Linus Rath	02703d8b3d	fix: stop not-found pages outside the app tree from being framed ... Paths the proxy skips (static files, `/_next`, `/api`) got no security headers at all, so the not-found shell rendered for a missing `/foo.html`, `/branding/x` or an unknown `/api` route could be framed by any site. Skipped responses now carry `nosniff` and `X-Frame-Options: DENY`, and non-API ones `frame-ancestors 'none'`; API routes keep setting their own CSP.	2026-09-26 16:22:49 +02:00
Linus Rath	e7dc992721	fix: never let ALLOWED_FRAME_ANCESTORS frame the admin dashboard or setup	2026-09-26 16:21:02 +02:00
Linus Rath	f086d21d84	docs: use framed standard-theme screenshots in the readme	2026-09-22 23:04:27 +02:00
Linus Rath	9bc54a4ef6	fix: keep security headers on dotted app paths and neutralise cid: blobs (GHSA-xvjh-v9c6-qcvc)	2026-09-17 21:08:37 +02:00