What the issue is & The core problem
The application lacks strict CSP headers, leaving it vulnerable to Cross-Site Scripting (XSS) if third-party dependencies are compromised.
Specific files to be changed
index.htmlvite.config.ts
Detailed proposed solution
Configure the Vite build or the backend hosting provider to inject strict Content-Security-Policy HTTP headers, restricting script-src and connect-src to known domains.
Impact/Effect on the project
Provides a robust defense-in-depth layer against malicious script execution.
Benefits to the maintainers/users
Ensures user sessions and local storage data remain secure against XSS exfiltration.
Assignment Request
Hey maintainers, I would like to work on this issue. Could you please assign it to me and add the ECSoC26, Level 3, and good-backend labels?
Program: ECSoC'26
What the issue is & The core problem
The application lacks strict CSP headers, leaving it vulnerable to Cross-Site Scripting (XSS) if third-party dependencies are compromised.
Specific files to be changed
index.htmlvite.config.tsDetailed proposed solution
Configure the Vite build or the backend hosting provider to inject strict
Content-Security-PolicyHTTP headers, restrictingscript-srcandconnect-srcto known domains.Impact/Effect on the project
Provides a robust defense-in-depth layer against malicious script execution.
Benefits to the maintainers/users
Ensures user sessions and local storage data remain secure against XSS exfiltration.
Assignment Request
Hey maintainers, I would like to work on this issue. Could you please assign it to me and add the
ECSoC26,Level 3, andgood-backendlabels?Program: ECSoC'26