Context
src-tauri/tauri.conf.json ships "security": { "csp": null }, so Tauri injects no Content-Security-Policy into app webviews. Article content is untrusted remote HTML; today the only defense is DOMPurify sanitization at render time (sanitizeHtml in viewer/02-utils.js). That has held up, but a CSP is the standard second layer if a sanitizer bypass ever appears.
Ask
Define a CSP that the viewer can actually live with — needs img-src/media-src for arbitrary article images and enclosures, inline styles for the email-style HTML, and script only from self (the viewer is fully inlined; no external scripts by design). Verify TTS, mermaid, hls.js, and YouTube embeds still work before shipping.
Found during the August 2026 security sweep (same sweep that removed the wildcard CORS headers from the local API).
Filed by Claude Code on behalf of @shellen.
Context
src-tauri/tauri.conf.jsonships"security": { "csp": null }, so Tauri injects no Content-Security-Policy into app webviews. Article content is untrusted remote HTML; today the only defense is DOMPurify sanitization at render time (sanitizeHtmlinviewer/02-utils.js). That has held up, but a CSP is the standard second layer if a sanitizer bypass ever appears.Ask
Define a CSP that the viewer can actually live with — needs
img-src/media-srcfor arbitrary article images and enclosures, inline styles for the email-style HTML, and script only from self (the viewer is fully inlined; no external scripts by design). Verify TTS, mermaid, hls.js, and YouTube embeds still work before shipping.Found during the August 2026 security sweep (same sweep that removed the wildcard CORS headers from the local API).
Filed by Claude Code on behalf of @shellen.