petrbalvin a2f42c6a12 security: add Content-Security-Policy header for admin routes ...

Set a strict CSP on all /admin/* responses: default-src 'self',
script/style 'unsafe-inline' (needed for the inline editor JS and
layout CSS), img-src 'self' data:, frame-ancestors 'none'. Public
API routes are unaffected. Bump ClassLength limit to 420 to
accommodate the new helper.

2026-06-26 20:41:10 +02:00

..

volumen

security: add Content-Security-Policy header for admin routes

2026-06-26 20:41:10 +02:00

volumen.rb

fix: add periodic cleanup of login_attempts hash

2026-06-25 21:40:37 +02:00