05/25 Improvement 1

app/__init__.py

@@ -170,6 +170,26 @@ def create_app(config_name='default'):
     csrf.exempt(_api_notifications_bp)
     register_api(app)
 
+    # ── Security response headers ─────────────────────────────────────────
+    # Applied to every response. Blocks clickjacking, MIME sniffing, and
+    # obvious XSS vectors without breaking Bootstrap CDN / Google Fonts.
+    @app.after_request
+    def set_security_headers(response):
+        response.headers.setdefault('X-Content-Type-Options', 'nosniff')
+        response.headers.setdefault('X-Frame-Options', 'SAMEORIGIN')
+        response.headers.setdefault('Referrer-Policy', 'strict-origin-when-cross-origin')
+        response.headers.setdefault(
+            'Content-Security-Policy',
+            "default-src 'self'; "
+            "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
+            "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; "
+            "font-src 'self' data: https://fonts.gstatic.com https://cdn.jsdelivr.net; "
+            "img-src 'self' data: blob:; "
+            "connect-src 'self'; "
+            "frame-ancestors 'none';"
+        )
+        return response
+
     # ── Error handler: 413 Request Entity Too Large ───────────────────────
     # Nginx can return 413 before Flask sees the request; this handler covers
     # the Flask-side rejection and gives users a clear, actionable message