cloakyard
diff --git a/‎SECURITY.md‎
Lines changed: 14 additions & 1 deletion b/‎SECURITY.md‎
Lines changed: 14 additions & 1 deletion
diff --git a/‎index.html‎
Lines changed: 19 additions & 0 deletions b/‎index.html‎
Lines changed: 19 additions & 0 deletions
diff --git a/‎package.json‎
Lines changed: 1 addition & 1 deletion b/‎package.json‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎pnpm-lock.yaml‎
Lines changed: 29 additions & 29 deletions b/‎pnpm-lock.yaml‎
Lines changed: 29 additions & 29 deletions
@@ -27,4 +27,17 @@ CloakPDF is a **client-side only** application — all PDF processing happens in
 
 ## Dependency Vulnerabilities
 
-Known dependency vulnerabilities are tracked automatically via GitHub Dependabot and the weekly security audit workflow. If you spot one that has not been addressed, please follow the disclosure process above.
+Known dependency vulnerabilities are tracked automatically via:
+
+- **GitHub Dependabot** — daily checks against the GitHub Advisory Database
+- **OSV-Scanner** — weekly CI workflow against the Open Source Vulnerabilities database
+
+If you spot one that has not been addressed, please follow the disclosure process above.
+
+## Defence-in-Depth Controls
+
+- **Content Security Policy** — declared via `<meta http-equiv="Content-Security-Policy">` in [`index.html`](./index.html). `connect-src` is restricted to the application origin and the public CDNs that serve the Tesseract OCR engine and language data, making it physically impossible for the page to upload user file content elsewhere.
+- **Subresource integrity** — all first-party JavaScript is bundled and served from the same origin under hashed filenames.
+- **No tracking or analytics** — the page makes no third-party network requests at runtime beyond what is listed above.
+
+_Last reviewed: 2026-04-17._
@@ -3,6 +3,17 @@
   <head>
     <meta charset="UTF-8" />
 
+    <!--
+      Content Security Policy — enforces the "no uploads, 100% private" promise.
+      `connect-src` is intentionally narrow: only the CDNs that deliver the
+      Tesseract OCR engine and language data are permitted. There is no path
+      for user file content to leave the browser.
+    -->
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self'; script-src 'self' 'wasm-unsafe-eval' blob: https://cdn.jsdelivr.net https://unpkg.com; worker-src 'self' blob: https://cdn.jsdelivr.net https://unpkg.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' blob: https://cdn.jsdelivr.net https://unpkg.com https://tessdata.projectnaptha.com; object-src 'none'; base-uri 'self'; form-action 'self'; manifest-src 'self'"
+    />
+
     <!-- SVG favicon (primary + only) -->
     <link rel="icon" href="/icons/favicon.svg" type="image/svg+xml" />
 
@@ -16,6 +27,14 @@
     <meta name="theme-color" content="#2563EB" />
     <meta name="color-scheme" content="light dark" />
 
+    <!-- Preload primary font so first paint uses Inter, not the system fallback -->
+    <link rel="preload" href="/fonts/InterVariable.woff2" as="font" type="font/woff2" crossorigin />
+
+    <!-- Resource hints for runtime CDNs (PDF.js worker, Tesseract.js core + lang data) -->
+    <link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin />
+    <link rel="preconnect" href="https://unpkg.com" crossorigin />
+    <link rel="dns-prefetch" href="https://tessdata.projectnaptha.com" />
+
     <!-- iOS PWA -->
     <link rel="apple-touch-icon" href="/icons/apple-touch-icon.png" />
     <meta name="mobile-web-app-capable" content="yes" />
 
@@ -30,7 +30,7 @@
     "@vitejs/plugin-react": "^6.0.1",
     "@voidzero-dev/vite-plus-core": "^0.1.18",
     "tailwindcss": "^4.2.2",
-    "typescript": "^6.0.2",
+    "typescript": "^6.0.3",
     "vite": "npm:@voidzero-dev/vite-plus-core@^0.1.18",
     "vite-plugin-pwa": "^1.2.0",
     "vite-plus": "latest"