fix: add script-src and worker-src to CSP for Sentry replay

- script-src 'unsafe-inline' allows the Google Fonts onload handler
- worker-src blob: allows Sentry replay's Web Worker

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: julianknutsen

internal/api/security.go

@@ -5,7 +5,7 @@ import "net/http"
 // SecurityHeaders wraps a handler with standard security response headers.
 func SecurityHeaders(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.nango.dev https://*.ingest.us.sentry.io; img-src 'self' data:")
+		w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.nango.dev https://*.ingest.us.sentry.io; worker-src 'self' blob:; img-src 'self' data:")
 		w.Header().Set("X-Frame-Options", "DENY")
 		w.Header().Set("X-Content-Type-Options", "nosniff")
 		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")

internal/api/security_test.go

@@ -21,7 +21,7 @@ func TestSecurityHeaders(t *testing.T) {
 		header string
 		want   string
 	}{
-		{"Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.nango.dev https://*.ingest.us.sentry.io; img-src 'self' data:"},
+		{"Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.nango.dev https://*.ingest.us.sentry.io; worker-src 'self' blob:; img-src 'self' data:"},
 		{"X-Frame-Options", "DENY"},
 		{"X-Content-Type-Options", "nosniff"},
 		{"Referrer-Policy", "strict-origin-when-cross-origin"},