Merge pull request #1051 from agenes01/feat/issue-1004-xss-csp-prevention

feat(#1004): implement XSS prevention with Content Security Policy

Author: Smartdevs17

app.json

@@ -48,7 +48,16 @@
     "web": {
       "favicon": "./assets/subtrackr-icon.png",
       "name": "SubTrackr - Subscription Management with Crypto Payments",
-      "description": "Manage your subscriptions with Web3 crypto payments"
+      "description": "Manage your subscriptions with Web3 crypto payments",
+      "meta": {
+        "http-equiv": {
+          "Content-Security-Policy": "default-src 'self'; script-src 'self' 'strict-dynamic'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https://api.subtrackr.app; font-src 'self' https://fonts.gstatic.com; object-src 'none'; media-src 'none'; frame-src 'none'; frame-ancestors 'none'; form-action 'self'; base-uri 'self'; upgrade-insecure-requests",
+          "X-Content-Type-Options": "nosniff",
+          "X-Frame-Options": "DENY",
+          "Referrer-Policy": "strict-origin-when-cross-origin",
+          "Permissions-Policy": "geolocation=(), microphone=(), camera=()"
+        }
+      }
     },
     "extra": {
       "eas": {