From 7edad31743c92cb9cff29eb5deb9f9e99243f0ba Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Mon, 26 Oct 2026 09:44:32 +0000 Subject: [PATCH] CSP: allow the footer's built.indie + pwamart badges Anthony: "add a pwamart.com badge to all our sites". @profullstack/footer carries the built.indie badge and, since 0.2.6, the pwamart badge (https://pwamart.com/for.svg?site=); this site's CSP img-src blocked both images. It now names the two hosts (not an open img-src). No ad units. Co-Authored-By: Claude Opus 5.5 --- apps/web/next.config.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/web/next.config.mjs b/apps/web/next.config.mjs index 3135ae0..e894b72 100644 --- a/apps/web/next.config.mjs +++ b/apps/web/next.config.mjs @@ -12,7 +12,7 @@ const csp = [ "default-src 'self'", "script-src 'self' 'unsafe-inline'", "style-src 'self' 'unsafe-inline'", - "img-src 'self' data:", + "img-src 'self' data: https://built.indie.pit.world https://pwamart.com", "font-src 'self' data:", // The download page reads release metadata from the GitHub API. "connect-src 'self' https://api.github.com",