🔒 Transparent security policy
Content Security Policy
These are the exact CSP directives applied to every Aegis Firma surface. This page is proof that customer data cannot leave our infrastructure to unknown third parties.
Last updated: August 2026 (unsafe-eval added for Cloudflare Turnstile support). Verify yourself: curl -I https://aegisfirma.com | grep -i content-security
Web App — aegisfirma.com
Applied to every route via Next.js headers config. Includes all dashboard pages, API routes, and public marketing pages.
| Directive | Value | What this means |
|---|---|---|
| default-src | 'self' | Baseline: only our own origin |
| script-src | 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com https://static.cloudflareinsights.com | unsafe-inline required by Next.js SSR hydration; unsafe-eval required by Cloudflare Turnstile's own hosted script (Cloudflare's documented, unavoidable requirement — Turnstile's api.js calls eval()/new Function() internally and cannot function without it); static.cloudflareinsights.com is Cloudflare Web Analytics, a cookie-less page-view counter injected at the edge that records no personal data and sets no identifier |
| style-src | 'self' 'unsafe-inline' | Tailwind CSS + Next.js inline styles |
| img-src | 'self' data: blob: https://*.supabase.co | User-uploaded evidence previews stored in Supabase |
| font-src | 'self' | Self-hosted only — no Google Fonts |
| frame-src | https://challenges.cloudflare.com | Cloudflare Turnstile renders its challenge in an iframe — the only iframe source permitted anywhere in the app |
| connect-src | 'self' https://*.supabase.co wss://*.supabase.co https://api.lemonsqueezy.com https://challenges.cloudflare.com https://cloudflareinsights.com | Supabase (data + realtime), LemonSqueezy billing, Cloudflare Turnstile, and Cloudflare Web Analytics (cookie-less aggregate page views). No ad networks, no cross-site trackers, no third-party data destinations for customer data. |
| object-src | 'none' | No plugins (Flash, PDF plugins, etc.) |
| base-uri | 'self' | Prevents base tag injection |
| form-action | 'self' | Forms only post to our own origin |
| frame-ancestors | 'none' | Cannot be embedded in any iframe — prevents clickjacking |
| upgrade-insecure-requests | (present, no value) | HTTP requests auto-upgraded to HTTPS |
Why unsafe-inline in script-src? Next.js SSR injects inline script tags for hydration. This is a known framework limitation. We compensate with
Why unsafe-eval in script-src? Cloudflare Turnstile — the bot-protection widget on signup and free-tool pages — cannot function without it; this is Cloudflare's own documented requirement, not a choice we made. It is scoped as narrowly as CSP allows: the alternative was Turnstile simply not working, which would have left signup and abuse-prevention broken instead.
frame-ancestors: none and strict connect-src allowlist. No data URIs in script-src, no CDN wildcards, no analytics or ad-network scripts.Why unsafe-eval in script-src? Cloudflare Turnstile — the bot-protection widget on signup and free-tool pages — cannot function without it; this is Cloudflare's own documented requirement, not a choice we made. It is scoped as narrowly as CSP allows: the alternative was Turnstile simply not working, which would have left signup and abuse-prevention broken instead.
Browser Extension — Chrome / Edge / Brave
MV3 extension. Extension pages enforce this CSP via manifest.json content_security_policy. The extension never connects to any third-party domain — only syncs to our own API when you explicitly click “Sync.”
| Directive | Value | What this means |
|---|---|---|
| script-src | 'self' | Extension pages only load scripts bundled with the extension |
| object-src | 'none' | No plugins |
| connect-src | 'self' https://aegisfirma.com | Extension only connects to our own API for sync — no third-party data destinations |
The “never sold” promise is technically enforced. The extension's connect-src only allows
https://aegisfirma.com. Data exfiltration to any other destination is impossible at the browser security level — not just a policy promise.Additional Security Headers
Applied alongside CSP on every response.
| Header | Value | Purpose |
|---|---|---|
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload | 2-year HSTS, preload-eligible |
| X-Frame-Options | DENY | Belt-and-suspenders alongside frame-ancestors CSP |
| X-Content-Type-Options | nosniff | Prevent MIME sniffing attacks |
| Referrer-Policy | strict-origin-when-cross-origin | Full URL only sent to same origin |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=(self) | Hardware access denied; payment APIs only on our origin |
| Cross-Origin-Opener-Policy | same-origin | Prevents cross-origin window sharing |
| Cross-Origin-Resource-Policy | same-origin | Resources not loadable by cross-origin pages |
What our CSP explicitly excludes
✓
No analytics scripts
No Google Analytics, Mixpanel, Segment, Hotjar, or any other analytics vendor in script-src or connect-src.
✓
No ad network scripts
No Facebook Pixel, Google Ads, or any advertising SDK loaded on any page.
✓
No CDN wildcards
connect-src uses an explicit allowlist. *.somecdn.com is not permitted.
✓
unsafe-eval scoped to one vendor
Present only because Cloudflare Turnstile's own script requires it — not used anywhere in our own code, and connect-src still blocks it from reaching anywhere but Cloudflare, Supabase, and LemonSqueezy.
✓
No cross-origin embeds
frame-ancestors: none prevents our app from being embedded in any iframe on any domain.
✓
No plugin objects
object-src: none blocks Flash, Java applets, and all legacy plugin content.