mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-28 17:42:50 +09:00
Jeremy Daer
f09110c14d
Campfire ships no CSP today (the initializer is the stock, fully-commented file). This adds a conservative Report-Only policy — default-src 'self'; object-src 'none'; base-uri/frame-ancestors/form-action 'self' — so browsers evaluate and report violations without enforcing anything. Rendering and behavior are unaffected. Next steps: wire a report endpoint, tune against observed violations, then flip content_security_policy_report_only off to enforce.