music_library/backlog/completed/ml-75 - Add-Content-Security-Policy-header-to-browser-pipeline.md

id, title, status, assignee, created_date, labels, dependencies, references, priority

id	title	status	assignee	created_date	labels	dependencies	references	priority
ML-75	Add Content-Security-Policy header to browser pipeline	Done		2026-04-20 08:56			https://github.com/cloud8421/music_library/issues/100	low

Description

GitHub: created 2026-03-07 · updated 2026-03-07 · closed 2026-03-07

Sobelow reports missing CSP on the browser pipeline (router.ex:14). Add a basic CSP via put_secure_browser_headers/2.

Currently the app does not set a Content-Security-Policy header, which is a defense-in-depth measure against XSS and other injection attacks.