SecurityHeaders (middleware/security.go)

HTTP middleware adding standard security headers and CSP for all responses.

// Source: https://github.com/metavert-io/lastsaas | License: MIT | Copyright 2026 Metavert LLC
// Provided via justclaw.it.com; keep this notice with the code.
package middleware

import (
	"net/http"
	"strings"
)

func SecurityHeaders(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("X-Content-Type-Options", "nosniff")
		w.Header().Set("X-XSS-Protection", "1; mode=block")
		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
		w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
		w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")

		// Allow /api/docs to be embedded by metavert.io; deny framing for everything else
		frameAncestors := "'no

... (truncated -- full source via MCP)