fix(security): CSP report-only and security headers by gabitoesmiapodo · Pull Request #424 · BootNodeDev/dAppBooster

gabitoesmiapodo · 2026-03-23T21:45:24Z

Summary

Add Content-Security-Policy-Report-Only header via vercel.json to capture violations without breaking the app
Add X-Content-Type-Options, X-Frame-Options, Referrer-Policy headers

Test plan

pnpm test passes
Deploy preview and check response headers contain CSP-Report-Only
Monitor CSP report endpoint for violations before switching to enforced mode

vercel · 2026-03-23T21:45:29Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
components.dappbooster	Ready	Preview, Comment	Mar 25, 2026 7:10pm
demo.dappbooster	Ready	Preview	Mar 25, 2026 7:10pm
docs.dappbooster	Ready	Preview, Comment	Mar 25, 2026 7:10pm

Copilot

Pull request overview

Adds security-related response headers at the Vercel edge to begin monitoring Content Security Policy violations (in Report-Only mode) and to set several baseline hardening headers for all routes.

Changes:

Configure Content-Security-Policy-Report-Only for all paths via vercel.json.
Add X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers globally.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-23T21:47:35Z

vercel.json

+      "headers": [
+        {
+          "key": "Content-Security-Policy-Report-Only",
+          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'; report-uri /csp-report"


report-uri /csp-report points to an endpoint that doesn’t appear to exist in the repo, and the current catch-all SPA rewrite (/(.*) -> /) will also rewrite /csp-report to /. As a result, CSP violation reports won’t be received/processed, which defeats the stated purpose of this PR. Consider either (a) implementing a real report ingestion endpoint (e.g., a Vercel Function) and exempting it from the rewrite, or (b) sending reports to an external HTTPS endpoint instead of a rewritten path.

Suggested change

"value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'; report-uri /csp-report"

"value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'; report-uri https://csp-report.example.com/report"

Copilot · 2026-03-23T21:47:35Z

vercel.json

+      "headers": [
+        {
+          "key": "Content-Security-Policy-Report-Only",
+          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'; report-uri /csp-report"


This CSP is extremely permissive for a report-only rollout (script-src includes 'unsafe-inline' and 'unsafe-eval', and connect-src allows any https:/wss:). With those allowances, many important violations won’t be reported, making the collected data much less actionable when switching to enforced mode. For the report-only phase, it’s usually better to start from a stricter baseline and add exceptions based on real violations.

Suggested change

"value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'; report-uri /csp-report"

"value": "default-src 'self'; script-src 'self' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https://va.vercel-scripts.com; frame-ancestors 'none'; report-uri /csp-report"

Copilot · 2026-03-23T21:47:35Z

vercel.json

+          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'; report-uri /csp-report"
+        },
+        {


report-uri is deprecated in favor of report-to / Reporting-Endpoints. If you’re adding CSP reporting infrastructure now, consider switching to the newer reporting directives (and adding the corresponding Report-To/Reporting-Endpoints header) to avoid having to migrate later.

Suggested change

"value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'; report-uri /csp-report"

},

{

"value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'; report-to csp-endpoint"

},

{

"key": "Report-To",

"value": "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/csp-report\"}]}"

},

{

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Add Content-Security-Policy-Report-Only via vercel.json headers to capture violations without breaking existing functionality - Add X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers

Copilot AI review requested due to automatic review settings March 23, 2026 21:45

Copilot started reviewing on behalf of gabitoesmiapodo March 23, 2026 21:45 View session

vercel bot deployed to Preview – components.dappbooster March 23, 2026 21:46 View deployment

vercel bot deployed to Preview – docs.dappbooster March 23, 2026 21:46 View deployment

vercel bot deployed to Preview – demo.dappbooster March 23, 2026 21:46 View deployment

Copilot AI reviewed Mar 23, 2026

View reviewed changes

gabitoesmiapodo mentioned this pull request Mar 23, 2026

feat: AI integration baseline #420

Open

5 tasks

gabitoesmiapodo force-pushed the fix/security branch from 8d78386 to 70507c5 Compare March 23, 2026 22:03

gabitoesmiapodo force-pushed the fix/seo branch from 87c9de1 to 080d617 Compare March 23, 2026 22:03

vercel bot deployed to Preview – components.dappbooster March 23, 2026 22:04 View deployment

vercel bot deployed to Preview – docs.dappbooster March 23, 2026 22:04 View deployment

vercel bot deployed to Preview – demo.dappbooster March 23, 2026 22:05 View deployment

gabitoesmiapodo force-pushed the fix/seo branch from 080d617 to 5957e47 Compare March 23, 2026 22:18

gabitoesmiapodo force-pushed the fix/security branch from 70507c5 to 08acfa1 Compare March 23, 2026 22:18

gabitoesmiapodo requested a review from Copilot March 23, 2026 22:18

Copilot started reviewing on behalf of gabitoesmiapodo March 23, 2026 22:19 View session

vercel bot deployed to Preview – components.dappbooster March 23, 2026 22:19 View deployment

vercel bot deployed to Preview – docs.dappbooster March 23, 2026 22:19 View deployment

vercel bot deployed to Preview – demo.dappbooster March 23, 2026 22:20 View deployment

Copilot AI reviewed Mar 23, 2026

View reviewed changes

gabitoesmiapodo force-pushed the fix/seo branch from 5957e47 to e8d3651 Compare March 23, 2026 23:26

gabitoesmiapodo force-pushed the fix/security branch from 08acfa1 to 3a38be8 Compare March 23, 2026 23:26

vercel bot deployed to Preview – components.dappbooster March 23, 2026 23:26 View deployment

vercel bot deployed to Preview – docs.dappbooster March 23, 2026 23:26 View deployment

vercel bot deployed to Preview – demo.dappbooster March 23, 2026 23:27 View deployment

fix(security): add CSP report-only header and security headers

d8cb437

- Add Content-Security-Policy-Report-Only via vercel.json headers to capture violations without breaking existing functionality - Add X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers

gabitoesmiapodo force-pushed the fix/seo branch from e8d3651 to d0c83c8 Compare March 24, 2026 00:03

gabitoesmiapodo force-pushed the fix/security branch from 3a38be8 to d8cb437 Compare March 24, 2026 00:04

vercel bot deployed to Preview – components.dappbooster March 24, 2026 00:04 View deployment

vercel bot deployed to Preview – docs.dappbooster March 24, 2026 00:04 View deployment

vercel bot deployed to Preview – demo.dappbooster March 24, 2026 00:05 View deployment

Merge branch 'fix/seo' into fix/security

c03c5cb

vercel bot deployed to Preview – components.dappbooster March 25, 2026 19:09 View deployment

vercel bot deployed to Preview – docs.dappbooster March 25, 2026 19:09 View deployment

vercel bot deployed to Preview – demo.dappbooster March 25, 2026 19:10 View deployment

fernandomg approved these changes Mar 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): CSP report-only and security headers#424

fix(security): CSP report-only and security headers#424
gabitoesmiapodo wants to merge 2 commits intofix/seofrom
fix/security

gabitoesmiapodo commented Mar 23, 2026

Uh oh!

vercel bot commented Mar 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	"value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'; report-uri /csp-report"
	"value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'; report-uri https://csp-report.example.com/report"

-          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'; report-uri /csp-report"
-        },
-        {
+          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'; report-to csp-endpoint"
+        },
+        {
+          "key": "Report-To",
+          "value": "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/csp-report\"}]}"
+        },
+        {

Conversation

gabitoesmiapodo commented Mar 23, 2026

Summary

Test plan

Uh oh!

vercel bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vercel bot commented Mar 23, 2026 •

edited

Loading