From c74c63ebd702e8b55eb4032900f20f9813d3b4f9 Mon Sep 17 00:00:00 2001
From: Pen Anderson <pen@pentacle.games>
Date: Tue, 26 May 2026 15:13:44 -0500
Subject: [PATCH] update csp

---
 web/svelte.config.js | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/web/svelte.config.js b/web/svelte.config.js
index edccda3..939b0eb 100644
--- a/web/svelte.config.js
+++ b/web/svelte.config.js
@@ -17,7 +17,20 @@ export default {
 		csp: {
 			mode: 'hash',
 			directives: {
-				'script-src': ['self']
+				'default-src': ['self'],
+				'script-src': ['self'],
+				'style-src': ['self', 'unsafe-inline'],
+				'img-src': ['self', 'data:', 'blob:'],
+				'media-src': ['self', 'blob:'],
+				'font-src': ['self', 'data:'],
+				'connect-src': ['self'],
+				'manifest-src': ['self'],
+				'worker-src': ['self'],
+				'object-src': ['none'],
+				'base-uri': ['self'],
+				'frame-ancestors': ['none'],
+				'form-action': ['self'],
+				'upgrade-insecure-requests': true
 			}
 		},
 		alias: {