Harden production security

main.go

@@ -18,7 +18,7 @@ import (
 	"time"
 )
 
-//go:embed static
+//go:embed static static/.well-known/security.txt
 var embedded embed.FS
 
 const banner = `
@@ -87,7 +87,17 @@ func main() {
 
 func withHeaders(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet && r.Method != http.MethodHead {
+			w.Header().Set("Allow", "GET, HEAD")
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+		w.Header().Set("Strict-Transport-Security", "max-age=31536000")
 		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
+		w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
+		w.Header().Set("Content-Security-Policy", "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; upgrade-insecure-requests")
 		w.Header().Set("X-No-Packets-Were-Harmed", "true")
 		next.ServeHTTP(w, r)
 	})

static/.well-known/security.txt

@@ -0,0 +1,4 @@
+Contact: https://github.com/AndriGitDev/hacktheplanet/security/advisories/new
+Expires: 2027-07-19T00:00:00Z
+Preferred-Languages: en, is
+Canonical: https://htp.kastro.is/.well-known/security.txt