Compare commits

...

2 Commits

Author SHA1 Message Date
posimai bdcd6fab62 chore: update posimai-guard submodule pointer 2026-04-23 00:07:55 +09:00
posimai 3925514cc9 security(csp): posimai-sc connect-src絞り込み
connect-srcをapi.soar-enrich.comのみに限定。
Alpine.js使用のためunsafe-evalは維持。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-23 00:07:26 +09:00
2 changed files with 2 additions and 2 deletions

@ -1 +1 @@
Subproject commit 223af134eeebd759eb31268387a544d71cb399fe
Subproject commit d112a301099be8b25059e4ca9398115715c58c5f

View File

@ -30,7 +30,7 @@
},
{
"key": "Content-Security-Policy",
"value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://unpkg.com https://cdn.jsdelivr.net https://esm.sh; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.gstatic.com https://posimai-ui.vercel.app; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: https:; media-src 'self' https:; connect-src 'self' https://api.soar-enrich.com wss://api.soar-enrich.com https:; worker-src 'self'; frame-ancestors 'none';"
"value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://unpkg.com https://cdn.jsdelivr.net https://esm.sh; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.gstatic.com https://posimai-ui.vercel.app; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: https:; media-src 'self' https:; connect-src 'self' https://api.soar-enrich.com wss://api.soar-enrich.com; worker-src 'self'; frame-ancestors 'none';"
},
{
"key": "Strict-Transport-Security",