feat: add CSP and security headers for web deployments

[CodeWithMaBot]

Summary by CodeRabbit

• New Features

  • Added production hosting support for the Angular application in Docker/Nginx environments.
  • Added fallback routing so application pages load correctly when accessed directly.
  • Added browser security protections, including content security, clickjacking, MIME-sniffing, and referrer controls.

• Performance

  • Enabled production optimizations for scripts, styles, and fonts to improve load performance.

[vercel]

@CodeWithMaBot is attempting to deploy a commit to the Ma's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 87b8ee8a-ab7f-4f6e-a517-c8784a9e6e21

📥 Commits

Reviewing files that changed from the base of the PR and between fd2f04e and 1c78275.

📒 Files selected for processing (4)

• Dockerfile
• angular.json
• nginx.conf
• src/index.html

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The production Angular build now enables optimization. The Docker image installs a custom Nginx configuration that serves the SPA, applies security headers, and supports client-side routing. The HTML document adds CSP and referrer-policy meta fallbacks.

Changes

Production delivery

Layer / File(s)	Summary
Production build optimization angular.json	The production configuration enables script optimization, style minification without critical CSS inlining, and font optimization.
Nginx delivery and routing nginx.conf, Dockerfile	The image copies the Nginx configuration into the default configuration path. Nginx serves the Angular output, applies CSP and security headers, and falls back to index.html for SPA routes.
Browser security fallback src/index.html	The document adds CSP and no-referrer meta tags for hosts that cannot send HTTP headers.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 1c782

This change enables production optimization and adds Nginx-delivered browser security headers with SPA routing and HTML policy fallbacks. No concrete merge-blocking risk remains in the current change.

Sequence Diagram(s)

sequenceDiagram
  participant DockerImage
  participant Nginx
  participant Browser
  DockerImage->>Nginx: Install default.conf
  Browser->>Nginx: Request application
  Nginx-->>Browser: Serve assets with security headers
  Nginx-->>Browser: Return index.html for client-side routes

Loading

Suggested reviewers: codewithma

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding CSP and security headers for web deployments through Nginx and the HTML fallback.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
watch-list	Ready	Preview	Sep 5, 2026 11:16am UTC