[Sub-Issue] Add Content Security Policy (CSP) Headers

[asthasinghcs]

Parent Issue

#227 - Comprehensive Code Audit

Problem

The audit identified missing Content Security Policy (CSP) headers.

Current security headers such as X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy are present in next.config.js, however a Content-Security-Policy header does not appear to be configured.

Proposed Work

• Review current frontend resource loading requirements
• Design an appropriate Content Security Policy
• Add CSP headers through the existing Next.js header configuration
• Verify application functionality is not impacted
• Document the policy and any required exceptions

Expected Outcome

• Improved protection against XSS and content injection attacks
• Stronger browser-side security posture
• Alignment with security recommendations from the audit

GSSoC

I would like to work on this issue under GSSoC'26.

[asthasinghcs]

@Soumya-codr

Created this sub-issue based on the audit finding regarding missing Content Security Policy (CSP) headers.

I'd like to work on this under GSSoC'26 and am requesting assignment.

Thanks.

[Soumya-codr]

Sure Go Ahead

Happy Coding