Buco7854 a4cc322a55 feat: apply status page CSP to custom domains ...

Detect custom domains by comparing the request host to the app host and apply
the tightened CSP there too, not just on the public path. Run the middleware
before express.static so static-served root documents get the header, and keep
helmet after static so its default-src does not block custom domain API calls.

2026-06-24 18:21:16 +00:00

..

helpers

update tests

2026-06-10 13:13:01 -07:00

integration

update tests

2026-06-10 09:30:24 -07:00

unit

feat: apply status page CSP to custom domains

2026-06-24 18:21:16 +00:00