Security — Encryption, hosting & the browser (2)

Every response also carries browser-level hardening: X-Content-Type-Options: nosniff so an uploaded file cannot be sniffed into executable script; a referrer policy that stops workspace, table and record ids leaking in the Referer of outbound clicks; a permissions policy denying geolocation, camera, microphone and payment outright, since nothing here asks for them; and a content-security policy setting object-src 'none', base-uri 'self' and form-action 'self'. Signed-in pages refuse to be framed at all; only the surfaces designed to be embedded on your own site — public forms and the chat widget — are framable, and a widget that names its allowed sites is restricted to them. Where that policy stops, and why: the content-security policy does not yet restrict script sources. Doing that properly means threading a nonce through every page rather than adding a header, and a policy with 'unsafe-inline' in it would be decoration — it would pass a scanner while blocking nothing. It is on the list as real work, not as a header we forgot.