security cleanup, fix turnstile

src/server/middleare/security-headers.ts

@@ -0,0 +1,19 @@
+import { defineMiddleware } from "vinxi/http";
+
+// Security headers middleware — sets CSP and hardening headers on all responses
+export default defineMiddleware((_event, next) => {
+  return next().then((response) => {
+    response.headers.set(
+      "Content-Security-Policy",
+      "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
+    );
+    response.headers.set("X-Content-Type-Options", "nosniff");
+    response.headers.set("X-Frame-Options", "DENY");
+    response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+    response.headers.set(
+      "Permissions-Policy",
+      "camera=(), microphone=(), geolocation=()"
+    );
+    return response;
+  });
+});