OpenCut-app / OpenCut-app/OpenCut
[SECURITY] Add Content Security Policy headers
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 89.8k
- Forks
- 8.9k
- PR merge metrics
- No merged PRs in 30d
Description
Description
No Content Security Policy (CSP) headers are configured in Next.js config. The app loads external scripts and images without CSP restrictions.
External Resources Currently Loaded
- `https://unpkg.com/react-scan/dist/auto.global.js\` (development)
- `https://cdn.databuddy.cc/databuddy.js\`
- Multiple image domains (Unsplash, GitHub avatars, Iconify API)
Risk
- External script injection attacks
- Style-based attacks
- Data exfiltration
Fix
Add CSP headers via `next.config.ts` headers or middleware with appropriate directives for `default-src`, `script-src`, `img-src`, etc.
Files
- `apps/web/next.config.ts`
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with apps/web/next.config.ts and review how the listed external scripts and image domains are loaded. Define CSP directives covering those resources while restricting scripts, styles, images, and other sources, then verify the application still loads the listed resources without overly broad allowances.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- next.js, typescript
- Domain
- security, web-dev
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100