tech-debt: CSP duplicated between index.html meta tag and generated policy.ts (drift risk)

[Ejirowebfi]

Summary

The Content-Security-Policy is maintained in two places that can drift: a hand-written <meta http-equiv="Content-Security-Policy"> in frontend/index.html and the generated source of truth in frontend/src/csp/policy.ts (emitted to headers via scripts/generateCSP.ts).

Evidence

• frontend/index.html contains a full connect-src/img-src CSP meta tag (its own comment warns it is a "development fallback only" and "do not edit by hand").
• frontend/src/csp/policy.ts is the generated/header source of truth.

The two lists of allowed origins are maintained separately, so adding/removing an endpoint in one can silently diverge from the other.

Suggested fix

Generate the dev index.html meta tag from policy.ts (the same source as the header), or drop the static directive list in favor of a placeholder the build replaces, so there is a single source of truth for allowed origins.

[kingAkinwale]

hi, i'd love to work on this. Can i get this please.

[matieuu1]

the hand-written meta tag in index.html and the generated source of truth in policy.ts are maintained separately, so adding/removing an endpoint in one silently diverges from the other. I'll generate the dev meta tag from policy.ts so there's a single source of truth for all allowed origins.

[OZILSOLAR]

Hi team!!!!
I would like to work on this issue!!!!!

[grantfox-oss]

🦊 GrantFox — @OZILSOLAR has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #855)
2. Your PR will be reviewed by the Favourorg maintainers

Good luck! Track your progress on GrantFox.