July 4 - Update security

control/panel/__init__.py

@@ -96,6 +96,7 @@ def create_panel_app():
     # ── Security headers ──────────────────────────────────────────────────
     @app.after_request
     def security_headers(response):
+        from flask import request as _request
         response.headers.setdefault('X-Content-Type-Options', 'nosniff')
         response.headers.setdefault('X-Frame-Options', 'DENY')
         response.headers.setdefault('Referrer-Policy', 'strict-origin-when-cross-origin')
@@ -106,8 +107,13 @@ def create_panel_app():
             "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
             "font-src 'self' https://cdn.jsdelivr.net; "
             "img-src 'self' data:; "
+            "object-src 'none'; base-uri 'self'; form-action 'self'; "
             "frame-ancestors 'none';"
         )
+        # HSTS over HTTPS only. The panel serves a single host (admin.jqc.app),
+        # so includeSubDomains is safe here — but kept off for parity/caution.
+        if _request.is_secure or _request.headers.get('X-Forwarded-Proto', '') == 'https':
+            response.headers.setdefault('Strict-Transport-Security', 'max-age=31536000')
         return response
 
     return app