The controller sends no Content-Security-Policy and no Strict-Transport-Security header.
svelte.config.js has no kit.csp.
guard.ts:106-110 sets Cache-Control, Referrer-Policy, nosniff and X-Frame-Options, but not CSP or HSTS.
Player names, chat and GitHub release notes are attacker-controlled. They're escaped today (there's no {@html} in the UI), so this is a second layer if that ever slips.
Fix
Add kit.csp with mode: 'auto', including default-src 'self', object-src 'none', base-uri 'self', form-action 'self' and frame-ancestors 'none'
Send Strict-Transport-Security on HTTPS responses
The controller sends no Content-Security-Policy and no Strict-Transport-Security header.
- `svelte.config.js` has no `kit.csp`.
- `guard.ts:106-110` sets Cache-Control, Referrer-Policy, nosniff and X-Frame-Options, but not CSP or HSTS.
Player names, chat and GitHub release notes are attacker-controlled. They're escaped today (there's no `{@html}` in the UI), so this is a second layer if that ever slips.
**Fix**
- [ ] Add `kit.csp` with `mode: 'auto'`, including `default-src 'self'`, `object-src 'none'`, `base-uri 'self'`, `form-action 'self'` and `frame-ancestors 'none'`
- [ ] Send `Strict-Transport-Security` on HTTPS responses
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The controller sends no Content-Security-Policy and no Strict-Transport-Security header.
svelte.config.jshas nokit.csp.guard.ts:106-110sets Cache-Control, Referrer-Policy, nosniff and X-Frame-Options, but not CSP or HSTS.Player names, chat and GitHub release notes are attacker-controlled. They're escaped today (there's no
{@html}in the UI), so this is a second layer if that ever slips.Fix
kit.cspwithmode: 'auto', includingdefault-src 'self',object-src 'none',base-uri 'self',form-action 'self'andframe-ancestors 'none'Strict-Transport-Securityon HTTPS responses