From 979bc14ca854b5aa718edaa25cf4357c9f28f032 Mon Sep 17 00:00:00 2001
From: Nicolas Varrot <contact@nicolasvarrot.fr>
Date: Fri, 13 Feb 2026 03:27:29 +0000
Subject: [PATCH] fix: add security headers and no-cache for index.html in
 nginx config

- X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy
- Prevent caching index.html so SPA updates are always picked up
- Add engines field (node >=18) and lint:fix script to package.json
---
 FEEDBACK.md  |  3 ++-
 nginx.conf   | 15 ++++++++++++++-
 package.json |  6 +++++-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/FEEDBACK.md b/FEEDBACK.md
index 2099f0e..a44fe11 100644
--- a/FEEDBACK.md
+++ b/FEEDBACK.md
@@ -537,7 +537,8 @@
 ## Item #50
 - **Date:** 2026-02-12
 - **Priority:** medium
-- **Status:** pending
+- **Status:** done
+- **Completed:** 2026-02-13 — commit `f09482e`
 - **Description:** Multi-tab — split view for 2 sessions side by side
   - Allow viewing 2 sessions simultaneously in a split pane layout
   - Drag-to-resize divider between panes
diff --git a/nginx.conf b/nginx.conf
index 5d4f5a2..0356d96 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -4,16 +4,29 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # Security headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
     location / {
         try_files $uri $uri/ /index.html;
     }
 
-    # Cache static assets
+    # Cache static assets (hashed filenames — safe to cache forever)
     location /assets/ {
         expires 1y;
         add_header Cache-Control "public, immutable";
     }
 
+    # Don't cache index.html (SPA entry point must always be fresh)
+    location = /index.html {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+        add_header Expires "0";
+    }
+
     # Gzip
     gzip on;
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript image/svg+xml;
diff --git a/package.json b/package.json
index d5a1637..de409fe 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,8 @@
     "dev": "vite",
     "build": "tsc -b && vite build",
     "lint": "eslint .",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "lint:fix": "eslint . --fix"
   },
   "dependencies": {
     "@radix-ui/react-collapsible": "^1.1.12",
@@ -63,5 +64,8 @@
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.48.0",
     "vite": "^7.3.1"
+  },
+  "engines": {
+    "node": ">=18"
   }
 }