No Content-Security-Policy headers — app vulnerable to XSS via LLM responses #17

New issue

Closed

opened 2026-05-09 05:20:08 +00:00 by Mark · 1 comment

Mark commented

2026-05-09 05:20:08 +00:00

Owner

Severity: Medium

Files: vite.config.ts, index.html, src/components/wizard/InterviewMode.tsx

Issue: The application has no Content-Security-Policy (CSP) headers configured. The Interview Mode renders LLM-generated content directly in the chat UI. Any future addition of markdown/rich rendering could introduce XSS via prompt injection.

Recommendations:

Add CSP headers via Vite plugin
If adding markdown rendering, use DOMPurify for sanitization
Sanitize LLM responses as defense-in-depth

**Severity:** Medium **Files:** `vite.config.ts`, `index.html`, `src/components/wizard/InterviewMode.tsx` **Issue:** The application has no Content-Security-Policy (CSP) headers configured. The Interview Mode renders LLM-generated content directly in the chat UI. Any future addition of markdown/rich rendering could introduce XSS via prompt injection. **Recommendations:** 1. Add CSP headers via Vite plugin 2. If adding markdown rendering, use DOMPurify for sanitization 3. Sanitize LLM responses as defense-in-depth