🟠 [Launch-blocker] You serve other people's HTML on your own origin with zero security headers

[serenakeyitan]

Doc-serve responses set Content-Type and stop — no CSP, no X-Frame-Options, no nosniff. Any published doc can be iframed into clickjacking or MIME-sniffed into executing, on your origin. For an HTML publisher this isn't theoretical.

Evidence

worker/worker.js:1616 — doc-serve / fork-export Response sets Content-Type
only; no CSP / X-Frame-Options / X-Content-Type-Options / Referrer-Policy / HSTS.
Author HTML is served on the worker's own origin (clickjacking/MIME-sniff in scope).

Root cause — Author-supplied HTML is served from the worker's own origin with no framing or MIME-sniff protection, so a malicious or compromised doc can be clickjacked or sniffed into executing.

The fix — Add the headers in the html() helper (or a Cloudflare Transform Rule):

  const headers = {
    'Content-Type': 'text/html; charset=utf-8',
+   'X-Content-Type-Options': 'nosniff',
+   'Referrer-Policy': 'strict-origin-when-cross-origin',
+   'Content-Security-Policy': "frame-ancestors 'self'",
+   'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
  };

Verify — curl -sI https://<worker>/d/<slug>/v/1 | grep -iE 'x-content-type|referrer|content-security|strict-transport' should list all four.

---

_{🌳 Found by First Tree · production-readiness scan. Don't want to fix these one by one? Log in to First Tree and it fixes them all at once — free.}