SylvaCrypt/index.html at main · Forestritium/SylvaCrypt · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="UTF-8" />
    <link rel="icon" type="image/png" href="/favicon.png" />
    <link rel="manifest" href="/manifest.json" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <meta name="mobile-web-app-capable" content="yes" />
    <meta name="apple-mobile-web-app-capable" content="yes" />
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
    <meta name="apple-mobile-web-app-title" content="SylvaCrypt" />
    <link rel="apple-touch-icon" href="/icon-192x192.png" />
    <meta name="theme-color" content="#09090b" />
    <meta name="msapplication-TileColor" content="#09090b" />
    <meta name="msapplication-TileImage" content="/icon-192x192.png" />
    <meta name="msapplication-square150x150logo" content="/icon-192x192.png" />
    <meta name="msapplication-wide310x150logo" content="/icon-512x512.png" />
    <meta name="msapplication-square310x310logo" content="/icon-512x512.png" />
    <title>SylvaCrypt</title>
    <meta name="description" content="Zero-knowledge end-to-end encrypted messaging" />
    <!--
      Content Security Policy
      ─────────────────────────────────────────────────────────────────────────
      default-src 'self'       – block everything not explicitly listed
      script-src  'self' 'unsafe-inline' 'wasm-unsafe-eval'
                               – React/Vite inject inline bootstrap scripts;
                                 'unsafe-inline' is required until Vite ships
                                 nonce-based injection (tracked upstream).
                                 'wasm-unsafe-eval' allows WebAssembly compilation
                                 (e.g. Argon2id) without enabling arbitrary eval().
      style-src   'self' 'unsafe-inline'
                               – Tailwind + shadcn emit inline <style> nodes
      connect-src 'self' https://*.supabase.co wss://*.supabase.co
                               – Supabase REST, Auth, Realtime, and Storage APIs
      img-src     'self' data: blob: https://*.supabase.co
                               – decrypted chat images served as object URLs (blob:)
                                 and avatar thumbnails from Supabase Storage
      media-src   'self' blob:
                               – decrypted voice messages as object URLs (blob:)
      worker-src  'self' blob:
                               – future: Argon2id Web Worker
      font-src    'self' data:
      frame-src   'none'       – no iframes ever
      object-src  'none'       – no Flash / legacy embeds
      base-uri    'self'       – prevent base-tag hijacking
      form-action 'self'       – prevent form exfiltration
    -->
    <meta http-equiv="Content-Security-Policy" content="
      default-src 'self';
      script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval';
      style-src 'self' 'unsafe-inline';
      connect-src 'self' https://*.supabase.co wss://*.supabase.co;
      img-src 'self' data: blob: https://*.supabase.co;
      media-src 'self' blob:;
      worker-src 'self' blob:;
      font-src 'self' data:;
      object-src 'none';
      base-uri 'self';
      form-action 'self';
      report-uri /csp-report;
    " />
    <!--
      Permissions Policy (previously Feature Policy)
      ─────────────────────────────────────────────────────────────────────────
      microphone=*  – Allow microphone access on this domain only (voice messages)
      camera=*      – Allow camera access on this domain only (QR scanning)
      geolocation=() – Disable geolocation
    -->
    <meta http-equiv="Permissions-Policy" content="microphone=*, camera=*, geolocation=()" />
  </head>
  <body>
    <div id="root"></div>
    <script type="module" src="/src/main.tsx"></script>
  </body>
</html>