Security: add standard HTTP security headers

[spaciousejar]

Summary

The site is missing several standard HTTP security headers that provide defense-in-depth against common attack classes. While Vercel sets some defaults (HSTS on vercel.app domains), explicit configuration ensures consistent behavior regardless of host.

Missing headers

Header	Purpose	Recommended Value
X-Content-Type-Options	Prevents MIME-type sniffing	nosniff
X-Frame-Options	Prevents clickjacking via iframe embedding	DENY
Referrer-Policy	Controls referrer header leakage	strict-origin-when-cross-origin
Permissions-Policy	Restricts browser API access (camera, mic, etc.)	camera=(), microphone=(), geolocation=()

Suggested fix

Add these alongside the CSP in next.config.mjs:

async headers() {
  return [{
    source: '/(.*)',
    headers: [
      { key: 'X-Content-Type-Options', value: 'nosniff' },
      { key: 'X-Frame-Options', value: 'DENY' },
      { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
      { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
    ]
  }]
}

Impact

Trivial to add, zero behavioral change for legitimate users, blocks several classes of client-side attacks.