From 030679d19d4c29f30d524044e41dda9f2e0337b0 Mon Sep 17 00:00:00 2001
From: Kilian Mateo <13885240+kilianmc@users.noreply.github.com>
Date: Fri, 14 Aug 2026 11:15:34 +0200
Subject: [PATCH] chore: upgrade FastAPI/Starlette, add security response
 headers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

FastAPI 0.128.8 -> 0.141.1 and Starlette 0.52.1 -> 1.6.0, which is what
the six open Dependabot alerts needed; also pytest 9.1.1, ruff 0.16.3 and
uvicorn 0.52.3. Alerts are evaluated against the default branch, so they
clear at the first promotion to main, not on this merge.

Bumping fastapi alone did not move starlette: uv reported success and
left the pinned transitive version in place, so it needed an explicit
--upgrade-package. Worth knowing before trusting a lockfile diff.

The jump broke the route-enumeration security test silently. Since 0.137
include_router stores a tree node instead of copying routes onto the
parent, so walking app.routes returned three routes where it returned
nine — and still passed, because a walk over nothing finds no
unprotected endpoints. The walk now goes through iter_route_contexts, and
a canary asserts a known-protected route is visible in it and absent from
PUBLIC_ROUTES, so this file cannot go vacuous unnoticed again.

Headers arrive in two layers. vercel.json covers what the CDN serves; a
plain ASGI middleware covers /api/* in process, so the set also holds
under bare uvicorn and can be asserted in CI. It wraps send rather than
subclassing BaseHTTPMiddleware, which is what puts headers on the
responses no endpoint produced: 401, 403, 404, 422. The edge rule
deliberately overlaps /api/*, because a 500 from an unhandled exception
comes from ServerErrorMiddleware, built outside the user middleware
stack, and never reaches the wrapper.

The document policy carries no unsafe-* token: React sets inline styles
through CSSOM, which CSP does not govern, so style-src stays 'self'.
Strict-Transport-Security is left to Vercel, which already sends it — a
duplicate field is ignored rather than merged. Cross-Origin-Resource-
Policy is never set, since same-origin would stop the shell loading
remoteEntry.js in PR #5. Permissions-Policy lists only what it
restricts, leaving screen-wake-lock, fullscreen and autoplay at their
defaults for the session player. The /api/docs CSP exemption is derived
from the configured docs URLs rather than written as a literal, so it is
empty in production where they are None.

Adds .github/dependabot.yml for uv, npm and github-actions, grouped and
weekly, with @types/node held at the Node 24 major. Dependabot reads the
config from the default branch only, so a byte-identical twin on main is
required before it does anything.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml               |  50 ++++++++
 CLAUDE.md                            | 171 ++++++++++++++++++++++++++-
 package.json                         |   2 +-
 pyproject.toml                       |  12 +-
 server/app.py                        |  11 ++
 server/security_headers.py           |  74 ++++++++++++
 tests/test_auth_routes_enumerated.py |  37 +++++-
 tests/test_security_headers.py       | 139 ++++++++++++++++++++++
 uv.lock                              |  74 ++++++------
 vercel.json                          |  24 ++++
 web/vite.config.ts                   |  40 +++++++
 11 files changed, 583 insertions(+), 51 deletions(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 server/security_headers.py
 create mode 100644 tests/test_security_headers.py

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..ae3c110
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,50 @@
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    target-branch: "dev"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore"
+    groups:
+      python:
+        applies-to: version-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: "npm"
+    directory: "/web"
+    target-branch: "dev"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore"
+    groups:
+      web:
+        applies-to: version-updates
+        patterns:
+          - "*"
+    ignore:
+      - dependency-name: "@types/node"
+        update-types:
+          - "version-update:semver-major"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    target-branch: "dev"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore"
+    groups:
+      actions:
+        applies-to: version-updates
+        patterns:
+          - "*"
diff --git a/CLAUDE.md b/CLAUDE.md
index a8ee9ca..ad2dff7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -499,6 +499,71 @@ Non-negotiable. The realistic threat is bulk data extraction, not defacement.
     Public Suffix List, so a preview URL is genuinely **cross-site** and the cookie
     cannot work there. Previews fall back to demo mode.
 
+### Security response headers (v1.3.0)
+
+Two delivery points, because their coverage differs: `vercel.json` `headers` for what the
+**CDN** serves (SPA document, JS, CSS), and `server/security_headers.py` for **`/api/*`
+JSON** — in-process, so it also applies under bare `uvicorn` and is assertable in CI. The
+overlap is deliberate: a header set stops being sent without anything failing.
+
+| Header | Document (`vercel.json`) | `/api/*` (middleware) |
+| --- | --- | --- |
+| `Strict-Transport-Security` | **not ours** — Vercel sends `max-age=63072000` | same |
+| `X-Content-Type-Options` | `nosniff` | `nosniff` |
+| `Referrer-Policy` | `no-referrer` | `no-referrer` |
+| `X-Frame-Options` | `DENY` | `DENY` |
+| `Cross-Origin-Opener-Policy` | `same-origin` | `same-origin` |
+| `Permissions-Policy` | deny list below | same |
+| `Content-Security-Policy` | document policy below | `default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'` |
+| `Cross-Origin-Resource-Policy` / `-Embedder-Policy` | **never set** | **never set** |
+
+Document CSP, enforcing (not Report-Only):
+
+```text
+default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:;
+font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none';
+form-action 'none'; frame-src 'none'; frame-ancestors 'none';
+upgrade-insecure-requests
+```
+
+- **No `unsafe-*` anywhere, `style-src` included.** React's `style={{…}}` writes through
+  **CSSOM, which CSP does not govern**; only literal `style=` attributes in served markup
+  need `'unsafe-inline'`, and SCSS compiles to external files. If something ever does need
+  it, `vite preview` fails loudly — re-add one token then, with a reason. An `unsafe-*` kept
+  "just in case" is how a CSP stays permanently weak.
+- **`img-src data:`** — Vite inlines assets under 4 KB as `data:` URLs.
+- **We do not set HSTS.** Vercel already sends `max-age=63072000` (verified `curl -sI`,
+  2026-08-14), and duplicate STS fields are **not merged** — RFC 6797 §8.1 processes only
+  the first. Cost: it is the one header we do not own, hence item 9.
+- **⚠️ Never set `Cross-Origin-Resource-Policy`.** `same-origin` would stop kilianmc.com
+  loading `/remoteEntry.js` and `/assets/*`. **This, not `frame-ancestors`, is the header
+  that breaks the federated mount.** `cross-origin` is a no-op, and on `/api/*` a
+  restrictive value sits in the path of the federated app's credentialed `fetch()` for no
+  gain over CORS + Bearer. No `Cross-Origin-Embedder-Policy` either — `require-corp` blocks
+  every cross-origin subresource and nothing needs `SharedArrayBuffer`. No `sandbox` in the
+  API CSP: without `allow-downloads` it would break a future export endpoint.
+- **`Permissions-Policy` lists only what we restrict; unlisted keeps the browser default.**
+  `camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), bluetooth=(),
+  midi=(), display-capture=(), idle-detection=()`. ⚠️ **`screen-wake-lock`, `fullscreen`
+  and `autoplay` must stay absent** — the session player needs all three. Tested, because
+  "deny everything unused" is the change that would add them.
+- **The `/api/docs` CSP exemption is derived from `app.docs_url` / `app.openapi_url`, never
+  hardcoded** — both are `None` in production, so the exempt set is empty there. Swagger UI
+  loads its assets from a CDN that `default-src 'none'` would block. Tested.
+- **Middleware ordering:** `add_middleware` prepends, so the last added is outermost. The
+  headers middleware is added last, outside CORS, and writes only its own header names —
+  never `Access-Control-*` or `Vary`. Wrapping `send` is what covers the 401 / 403 / 404 /
+  422 no endpoint produced. The two layers' coverage is not identical; hence both.
+- **`vercel.json`'s `/(.*)` block intentionally overlaps `/api/*`.** Whether Vercel
+  overwrites or appends on function responses is **unverified** — item 9 must `curl -sI` an
+  `/api/*` path on the real deploy and check no header appears twice.
+- **`vite dev` deliberately gets no CSP** — its inline client and HMR websocket would need a
+  laxer policy than production, proving less. `vite preview` serves the real build with the
+  real headers, read out of `vercel.json` by `web/vite.config.ts` so the two cannot drift.
+- **For PR #5:** the *shell's* CSP governs the federated mount, not ours. `portfolio-shell`
+  has none today; if it gains one it needs `script-src` **and** `connect-src` for
+  `https://climb.kilianmc.com`.
+
 ### Auth implementation (PR #3) — where each piece lives
 
 `server/auth/` — `passwords.py`, `tokens.py`, `refresh.py`, `cookies.py`,
@@ -599,9 +664,16 @@ against the **production deploy**, not a preview: previews are cross-site
   8. **Login rate limit** — it trips; the 429 is byte-identical for a real and a
      non-existent address; it self-heals within the window and no account is ever
      disabled.
-  9. **Security response headers** — once that PR has landed: HSTS, CSP,
-     `Referrer-Policy`, `X-Content-Type-Options`, and **verify `frame-ancestors` does not
-     break the federated mount inside `portfolio-shell`** (this is the one that will).
+  9. **Security response headers** — landed in v1.3.0; see the baseline section above. On
+     the real deploy check that the `vercel.json` layer reaches **`/api/*`** and that no
+     header (notably `Strict-Transport-Security`) appears **twice**, and that the document
+     CSP logs no console violations on a real page load.
+     - **CORRECTED 2026-08-14:** the original wording predicted `frame-ancestors` would
+       break the federated mount. It cannot. The shell mounts us as a **script**
+       (`React.lazy(() => import('climbTrainer/App'))`), never in an iframe — verified in
+       `portfolio-shell/src/components/ProjectViewer.tsx`, whose `<iframe>` branch is the
+       *other* pattern (`kind: 'embedded'`). **`Cross-Origin-Resource-Policy` is the header
+       that would break it**; verify it is still set nowhere.
   10. **No secret in the client bundle** — grep the built `web/dist` for any value of a
       non-`VITE_` env var, and for anything resembling `AUTH_SECRET`.
 - **Infra, outside the repo — these are the ones nothing else can catch:**
@@ -614,6 +686,12 @@ against the **production deploy**, not a preview: previews are cross-site
   13. **Zero open Dependabot alerts**, or each remaining one triaged with a written
       reason it does not apply. On 2026-08-13 there were 6 (starlette + pytest) and none
       were exploitable here, but "not exploitable" needs re-deciding per alert, not once.
+      v1.3.0 raises `starlette` to 1.6.0 and `pytest` to 9.1.1 without changing that
+      reasoning — still no `request.form()`, no `StaticFiles`, no `HTTPEndpoint`, and
+      nothing reading `request.url.path` or the Host header (`server/security_headers.py`
+      matches `scope["path"]`, the ASGI request target, by exact equality). **Alerts are
+      raised against the default branch, so they clear at the first promotion to `main`,
+      not on merge to `dev`.** Also confirm the Dependabot config is actually opening PRs.
   14. **2FA still enabled on GitHub, Vercel, Neon and Cloudflare.**
   15. **Neon CU-hours for the month match the model** in the compute-budget section. A
       figure well above it means something is waking the database — that is the signal.
@@ -735,14 +813,95 @@ in Python** — that was a fourth version string that would have drifted on the
 
 ## Branch model
 
-Two long-lived branches: **`dev`** (integration, the default branch) and **`main`**
-(production, `climb.kilianmc.com`). **All feature PRs target `dev`.** `main` receives
-only `dev`→`main` promotion PRs, merged by Kilian after he has tested the dev deploy.
+Two long-lived branches: **`dev`** (integration) and **`main`** (production,
+`climb.kilianmc.com`). **All feature PRs target `dev`.** `main` receives only
+`dev`→`main` promotion PRs, merged by Kilian after he has tested the dev deploy.
 Conventional Commits (`feat:`, `fix:`, `chore:`, `test:`, `docs:`); branches mirror
 the type (`feat/…`, `chore/…`).
 
+> **⚠️ `main` is the GitHub DEFAULT branch, not `dev`** (verified 2026-08-14,
+> `gh repo view --json defaultBranchRef`). GitHub reads several things **only** from the
+> default branch, so anything in that class needs a two-sided `dev` + `main` copy: so far
+> `.github/workflows/*.yml` (`workflow_dispatch` registration), `.github/dependabot.yml`,
+> and Dependabot **alerts**. This is the confusion behind the `migrate.yml` trap above.
+
 ---
 
+## 🧹 TODO — comment and docs deep clean (its own PR, AFTER PR #19)
+
+**Kilian's call, 2026-08-14: verbosity is FINE during development — do not spend review
+turns trimming prose while the project is still being built.** The clean-up is a single
+deliberate pass **once the project is done**, and it needs its own review, so it is not
+folded into the 1.0.0 promotion. Two goals, in this order:
+
+1. **Trim everything to the minimum.** Source comments: delete what restates the code and
+   all historical narrative; keep one-line constraints. **Convert "don't change this or X
+   breaks" into a test or a lint rule** rather than deleting it. `CLAUDE.md` / `README`:
+   trim narrative, **keep every trap and hard rule**.
+2. **Move the important stuff into a PRIVATE file so it is protected.** Design reasoning may
+   stay public; the **security control map, thresholds and infra topology go private**.
+   ⚠️ A public repo has **no per-file access control** and git history is permanent, so
+   anything moved **was already public** and must be re-thought or rotated, not just deleted
+   — which is the reason this is a real task and not a `git mv`.
+
+- **The dev journal stays public** — design and product decisions only, never where the
+  controls live or what their limits are.
+
+## Dependency policy (set by Kilian, 2026-08-14)
+
+**Pin every dependency to the latest stable version verified against the registry at pin
+time — never one recalled from memory.** Check PyPI / npm in the same turn you write the pin.
+This repo was scaffolded with `fastapi` 6 months, `starlette` 7 and `pytest` 9 months stale,
+which produced 6 Dependabot alerts and turned a day-one patch bump into a 0.x→1.x migration.
+
+Two exceptions: **runtimes track LTS** (Node 24, Python 3.13), and **`@types/*` match the
+runtime major, not the newest** — `@types/node` is held at 24 via an `ignore` entry, because
+type-checking against a runtime we do not run is a defect TypeScript accepts silently. The
+TypeScript 6.x hold in the frontend rules is a capability decision, not a staleness one.
+
+**Four upgrade traps, each already paid for:**
+
+- **`uv lock` will not move a transitive pin.** Bumping `fastapi` reported success and left
+  `starlette` at the vulnerable version. Needs `uv lock --upgrade-package starlette`, and
+  verify with `uv pip list`, not the `uv lock` output. `starlette` stays un-pinned in
+  `pyproject.toml`: it is FastAPI's dependency and a second pin could contradict its range.
+- **Since FastAPI 0.137, walk routes with `fastapi.routing.iter_route_contexts`, never
+  `app.routes`.** `include_router` stores a tree node, so direct iteration hides every
+  router-mounted endpoint — which made the deny-by-default walk in
+  `tests/test_auth_routes_enumerated.py` vacuous **while it still passed**. A canary test
+  now asserts a protected included route is in the walk; if it fails, fix the walk.
+- **`strict_content_type` is on by default since FastAPI 0.132**: a POST without
+  `content-type: application/json` is a 422. **PR #6 must send it** — `apiFetch` sets only
+  `accept`.
+- **`httpx2` replaces the `httpx` + `starlette.testclient` pairing** before Starlette 2.0,
+  where today's deprecation warning becomes an error. A package swap, not a version bump.
+
+### `.github/dependabot.yml`
+
+**Alerts alone open no pull requests** — which is why 6 stale-dependency alerts sat
+unnoticed with alerting fully enabled.
+
+- **⚠️ The file is read from the DEFAULT branch only**, i.e. `main`: *"The `dependabot.yml`
+  file must be present on the **default branch** … regardless of which branch you specify as
+  the target."* **A copy on `dev` alone is inert**, the same failure as `migrate.yml`. So it
+  needs the **byte-identical twin** treatment: two PRs, and **no comments in the YAML** (any
+  byte difference is an add/add conflict at the first promotion), which is why its reasoning
+  lives here.
+- **⚠️ Dependabot ALERTS are also raised against the default branch.** `main` still carries
+  the vulnerable `starlette`, so merging to `dev` does not clear the 6 open alerts — they
+  clear at the first promotion to `main`.
+- **`target-branch` and security updates conflict and cannot both be satisfied.**
+  `target-branch: dev` is set, because version-update PRs must not land on `main`. The docs:
+  *"Pull requests for security updates still target the default branch"*, and *"you should
+  not specify a `target-branch`"* for security updates. So security PRs ignore this config's
+  grouping and `ignore` rules and target `main`. **Currently theoretical —
+  `automated-security-fixes` is disabled on the repo**; enabling it is what makes this bite.
+  The alternative shape (a second block with no `target-branch` and
+  `open-pull-requests-limit: 0`) is unshipped because the docs do not say whether two blocks
+  may share an ecosystem + directory.
+
+Covered: `uv` at `/`, `npm` at `/web`, `github-actions` at `/`; weekly, grouped per ecosystem.
+
 ## Local development
 
 Two processes. The API on 8000, the SPA on 5173 with Vite proxying `/api` to it:
diff --git a/package.json b/package.json
index d59ae72..1f45f5c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "climb-trainer",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "private": true,
   "description": "Climbing training app — plan generator, guided session player, training diary",
   "engines": {
diff --git a/pyproject.toml b/pyproject.toml
index 996b620..38faefc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -11,7 +11,11 @@ dependencies = [
     # Pydantic's EmailStr is a no-op stub without it — it raises at model definition
     # time rather than validating, so this is a hard runtime dep, not an extra.
     "email-validator==2.3.0",
-    "fastapi==0.128.8",
+    # 0.141.x is the first line that allows starlette >= 1.0: FastAPI 0.128 pinned
+    # `starlette<1.0.0`, so the six Dependabot alerts against starlette 0.52.1 could not
+    # be closed without moving FastAPI too. See CLAUDE.md for what the 0.x -> 1.x jump
+    # actually required (0.132's strict_content_type is the one that touches us).
+    "fastapi==0.141.1",
     # psycopg3 (NOT asyncpg) — see server/db.py for why. The [binary] extra ships a
     # wheel with libpq bundled, so the Vercel Python image needs no system libpq.
     "psycopg[binary]==3.3.4",
@@ -31,9 +35,9 @@ dependencies = [
 dev = [
     "httpx==0.28.1",
     "mypy==2.3.0",
-    "pytest==9.0.1",
-    "ruff==0.15.1",
-    "uvicorn==0.39.0",
+    "pytest==9.1.1",
+    "ruff==0.16.3",
+    "uvicorn==0.52.3",
 ]
 
 [tool.setuptools]
diff --git a/server/app.py b/server/app.py
index 6c83e6f..2b94e53 100644
--- a/server/app.py
+++ b/server/app.py
@@ -15,6 +15,7 @@
 
 from server.auth.deps import enforce_auth
 from server.auth.routes import router as auth_router
+from server.security_headers import SecurityHeadersMiddleware
 from server.settings import app_version, get_settings
 
 settings = get_settings()
@@ -47,6 +48,16 @@
         allow_headers=["content-type", "authorization"],
     )
 
+# Swagger UI loads its assets from the jsdelivr CDN, which the API's `default-src 'none'`
+# would block. Derived from the configured docs URLs, not literals, so it follows
+# `_docs_enabled`: both are None in production, making this set empty there.
+_CSP_EXEMPT_PATHS = frozenset(p for p in (app.docs_url, app.openapi_url) if p is not None)
+
+# Added last, so it is the outermost middleware (`add_middleware` prepends) and also
+# covers the preflight responses CORS answers itself. It writes only its own header
+# names, never `Access-Control-*` or `Vary`.
+app.add_middleware(SecurityHeadersMiddleware, csp_exempt_paths=_CSP_EXEMPT_PATHS)
+
 
 app.include_router(auth_router)
 
diff --git a/server/security_headers.py b/server/security_headers.py
new file mode 100644
index 0000000..bdcbc30
--- /dev/null
+++ b/server/security_headers.py
@@ -0,0 +1,74 @@
+"""Security response headers for `/api/*`.
+
+`vercel.json` covers what the CDN serves (the SPA document, JS, CSS). This covers the
+API's JSON in-process, so it also applies under bare `uvicorn` and can be asserted in
+CI — see `tests/test_security_headers.py`.
+"""
+
+from typing import Final
+
+from starlette.datastructures import MutableHeaders
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+# Only features we mean to restrict are listed; an unlisted feature keeps its browser
+# default. `screen-wake-lock`, `fullscreen` and `autoplay` are deliberately absent — the
+# session player needs all three. Asserted in tests.
+PERMISSIONS_POLICY: Final = (
+    "camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), "
+    "bluetooth=(), midi=(), display-capture=(), idle-detection=()"
+)
+
+# The API returns JSON only, so it needs no sources at all. No `sandbox` directive:
+# without `allow-downloads` it would block a future export endpoint.
+API_CSP: Final = "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'"
+
+# `frame-ancestors 'none'` and `X-Frame-Options: DENY` are safe here because the shell
+# mounts this app as a script (`import('climbTrainer/App')`), never in an iframe.
+# `Cross-Origin-Resource-Policy` is deliberately unset — see CLAUDE.md for why.
+_HEADERS: Final[tuple[tuple[str, str], ...]] = (
+    ("X-Content-Type-Options", "nosniff"),
+    # Tighter than the browser default: nothing here needs a referrer.
+    ("Referrer-Policy", "no-referrer"),
+    ("X-Frame-Options", "DENY"),
+    ("Cross-Origin-Opener-Policy", "same-origin"),
+    ("Permissions-Policy", PERMISSIONS_POLICY),
+)
+
+# `Strict-Transport-Security` is deliberately not set: Vercel already sends it, and a
+# duplicate field is ignored rather than merged. See CLAUDE.md.
+
+
+class SecurityHeadersMiddleware:
+    """Stamps the header set onto every HTTP response.
+
+    A plain ASGI class rather than `BaseHTTPMiddleware`: wrapping `send` is what puts the
+    headers on the responses no endpoint produced (401, 403, 404, 422).
+
+    `csp_exempt_paths` is the only route to a response without a CSP. It is passed in from
+    `server/app.py`, derived from the configured docs URLs, and is empty in production.
+    """
+
+    def __init__(self, app: ASGIApp, *, csp_exempt_paths: frozenset[str] = frozenset()) -> None:
+        self.app = app
+        self.csp_exempt_paths = csp_exempt_paths
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+
+        # `scope["path"]`, not `request.url.path`: the ASGI request target rather than a
+        # URL rebuilt from the client-controlled Host header, matched by exact equality.
+        send_csp = scope.get("path") not in self.csp_exempt_paths
+
+        async def send_with_security_headers(message: Message) -> None:
+            if message["type"] == "http.response.start":
+                headers = MutableHeaders(scope=message)
+                # Assignment, not `setdefault`: a route must not be able to weaken these.
+                for name, value in _HEADERS:
+                    headers[name] = value
+                if send_csp:
+                    headers["Content-Security-Policy"] = API_CSP
+            await send(message)
+
+        await self.app(scope, receive, send_with_security_headers)
diff --git a/tests/test_auth_routes_enumerated.py b/tests/test_auth_routes_enumerated.py
index c3ecd35..8e9ae08 100644
--- a/tests/test_auth_routes_enumerated.py
+++ b/tests/test_auth_routes_enumerated.py
@@ -24,6 +24,7 @@
 from collections.abc import Iterator
 
 import pytest
+from fastapi.routing import iter_route_contexts
 from fastapi.testclient import TestClient
 from sqlalchemy.orm import Session
 
@@ -34,6 +35,11 @@
 
 _PATH_PARAM = re.compile(r"\{[^}]+\}")
 
+# A route that exists today, is NOT public, and is reached through `include_router`.
+# `test_the_walk_actually_sees_routes_behind_include_router` asserts the walk finds it —
+# see that test for the incident it guards.
+_CANARY_PROTECTED_ROUTE = ("GET", "/api/auth/me")
+
 client = TestClient(
     app,
     base_url="https://climb.kilianmc.com",
@@ -59,13 +65,19 @@ def _refuse() -> Iterator[Session]:
 def _registered_routes() -> list[tuple[str, str]]:
     """Every `(method, path)` the application actually serves.
 
+    **Must go through `iter_route_contexts`, not `app.routes`.** Since FastAPI 0.137,
+    `include_router` stores an intermediate node instead of copying routes onto the
+    parent, so `app.routes` is a tree and iterating it directly returns one opaque object
+    in place of every router-mounted endpoint. `iter_route_contexts` flattens it and
+    yields the effective path, with the router prefix applied.
+
     HEAD and OPTIONS are dropped: Starlette synthesises HEAD from GET and the CORS
     middleware owns OPTIONS, so neither is a route anyone declared.
     """
     routes: list[tuple[str, str]] = []
-    for route in app.routes:
-        path = getattr(route, "path", None)
-        methods = getattr(route, "methods", None)
+    for route in iter_route_contexts(app.routes):
+        path = route.path
+        methods = route.methods
         if not isinstance(path, str) or not methods:
             continue
         routes.extend(
@@ -74,6 +86,25 @@ def _registered_routes() -> list[tuple[str, str]]:
     return routes
 
 
+def test_the_walk_actually_sees_routes_behind_include_router() -> None:
+    """A floor under the other tests here: an empty walk must fail, not pass vacuously.
+
+    Every assertion below is decided by the route table, so they all succeed trivially if
+    `_registered_routes()` stops finding routes. A change that hid only the *protected*
+    routes would break nothing else in this file.
+    """
+    registered = set(_registered_routes())
+    assert _CANARY_PROTECTED_ROUTE in registered, (
+        f"{_CANARY_PROTECTED_ROUTE} is registered by server/auth/routes.py but the walk "
+        f"did not find it, so the other tests here are passing vacuously. Found: "
+        f"{sorted(registered)}. Fix `_registered_routes()` — do not update this canary."
+    )
+    assert _CANARY_PROTECTED_ROUTE not in PUBLIC_ROUTES, (
+        f"{_CANARY_PROTECTED_ROUTE} is now public, so it no longer canaries the protected "
+        f"half of the walk. Point this at another protected route."
+    )
+
+
 def _requestable(path: str) -> str:
     """Fill in path parameters so the request reaches the route it is aimed at."""
     return _PATH_PARAM.sub("1", path)
diff --git a/tests/test_security_headers.py b/tests/test_security_headers.py
new file mode 100644
index 0000000..2c5f15c
--- /dev/null
+++ b/tests/test_security_headers.py
@@ -0,0 +1,139 @@
+"""The `/api/*` security headers, asserted against real responses.
+
+A header set can stop being sent without anything failing, which is why the testing
+policy in CLAUDE.md earns this a file. `vercel.json` is deliberately not asserted here —
+that would restate config; it is verified on the real deploy and mirrored into
+`vite preview`.
+
+Error responses matter as much as the happy path: an ordering mistake shows up on a 401
+or a 404, not on a 200.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+
+from server.app import _CSP_EXEMPT_PATHS, app
+from server.security_headers import API_CSP, PERMISSIONS_POLICY
+from server.settings import get_settings
+
+client = TestClient(app, base_url="https://climb.kilianmc.com", raise_server_exceptions=False)
+
+# Every header the middleware is responsible for, with the exact value expected.
+_EXPECTED = {
+    "x-content-type-options": "nosniff",
+    "referrer-policy": "no-referrer",
+    "x-frame-options": "DENY",
+    "cross-origin-opener-policy": "same-origin",
+    "permissions-policy": PERMISSIONS_POLICY,
+    "content-security-policy": API_CSP,
+}
+
+_CORS_ORIGINS = get_settings().cors_origins
+
+
+@pytest.mark.parametrize(
+    ("method", "path", "expected_status"),
+    [
+        ("GET", "/api/health", 200),
+        # Responses no endpoint produced: a 401 from the auth gate, FastAPI's own JSON
+        # 404, and a validation 422. These are the ones a misplaced middleware loses.
+        ("GET", "/api/auth/me", 401),
+        ("GET", "/api/definitely-not-a-route", 404),
+        ("POST", "/api/auth/login", 422),
+    ],
+)
+def test_every_header_is_set_on_success_and_on_errors(
+    method: str, path: str, expected_status: int
+) -> None:
+    res = client.request(method, path)
+    assert res.status_code == expected_status, (
+        f"{method} {path} returned {res.status_code}, not {expected_status} — this test's "
+        f"premise (that it exercises that response path) no longer holds."
+    )
+    wrong = [
+        f"  {name}: expected {expected!r}, got {res.headers.get(name)!r}"
+        for name, expected in _EXPECTED.items()
+        if res.headers.get(name) != expected
+    ]
+    assert not wrong, (
+        f"{method} {path} -> {res.status_code} did not carry the expected security "
+        f"headers:\n" + "\n".join(wrong)
+    )
+
+
+def test_the_csp_permits_nothing_dangerous() -> None:
+    """`unsafe-eval` and a bare `*` are how a CSP becomes decorative."""
+    assert "unsafe-eval" not in API_CSP
+    assert "unsafe-inline" not in API_CSP
+    assert "*" not in API_CSP
+    assert "default-src 'none'" in API_CSP
+    assert "frame-ancestors 'none'" in API_CSP
+
+
+def test_permissions_policy_does_not_deny_the_features_the_player_needs() -> None:
+    """Unlisted means default, not denied — only list what you mean to restrict.
+
+    The session player owns a "Keep screen on" toggle and plays audio cues full-screen, so
+    denying these here would break it. This guards against a well-meant "deny everything
+    we are not using" change.
+    """
+    assert "screen-wake-lock" not in PERMISSIONS_POLICY
+    assert "fullscreen" not in PERMISSIONS_POLICY
+    assert "autoplay" not in PERMISSIONS_POLICY
+    assert "camera=()" in PERMISSIONS_POLICY
+    assert "geolocation=()" in PERMISSIONS_POLICY
+
+
+def test_docs_routes_are_exempt_from_the_csp_but_keep_the_other_headers() -> None:
+    """Swagger UI loads its assets from a CDN, which `default-src 'none'` would block.
+
+    The exemption must stay derived from the configured docs URLs rather than hardcoded,
+    so it empties itself when production turns the docs off.
+    """
+    assert _CSP_EXEMPT_PATHS == {p for p in (app.docs_url, app.openapi_url) if p is not None}, (
+        "the CSP exemption must be derived from app.docs_url / app.openapi_url"
+    )
+    assert app.docs_url is not None  # docs are on outside production
+
+    res = client.get(app.docs_url)
+    assert res.status_code == 200
+    assert "content-security-policy" not in res.headers
+    # The exemption covers the CSP and nothing else.
+    assert res.headers["x-content-type-options"] == "nosniff"
+    assert res.headers["x-frame-options"] == "DENY"
+
+
+@pytest.mark.skipif(
+    not _CORS_ORIGINS,
+    reason="CORS_ORIGINS is unset, so CORSMiddleware is not installed. Both "
+    "`npm run check:server` and CI set it.",
+)
+def test_cors_is_undisturbed_by_the_outer_headers_middleware() -> None:
+    """An allowed origin is echoed with `Vary: Origin`; an unknown origin gets no ACAO.
+
+    The headers middleware sits outside CORSMiddleware, so it could shadow it. The
+    preflight is checked too — CORS short-circuits it without reaching a route.
+    """
+    allowed = _CORS_ORIGINS[0]
+
+    res = client.get("/api/health", headers={"Origin": allowed})
+    assert res.headers["access-control-allow-origin"] == allowed
+    assert "origin" in res.headers.get("vary", "").lower()
+
+    preflight = client.options(
+        "/api/auth/login",
+        headers={
+            "Origin": allowed,
+            "Access-Control-Request-Method": "POST",
+            "Access-Control-Request-Headers": "content-type",
+        },
+    )
+    assert preflight.status_code == 200
+    assert preflight.headers["access-control-allow-origin"] == allowed
+    # Outermost placement means even the preflight carries the header set.
+    assert preflight.headers["x-content-type-options"] == "nosniff"
+
+    unknown = client.get("/api/health", headers={"Origin": "https://evil.example"})
+    assert "access-control-allow-origin" not in unknown.headers
+    # Still defended, even for an origin we refuse to talk to.
+    assert unknown.headers["content-security-policy"] == API_CSP
diff --git a/uv.lock b/uv.lock
index b25b3f6..d75d843 100644
--- a/uv.lock
+++ b/uv.lock
@@ -281,7 +281,7 @@ requires-dist = [
     { name = "alembic", specifier = "==1.19.1" },
     { name = "argon2-cffi", specifier = "==25.1.0" },
     { name = "email-validator", specifier = "==2.3.0" },
-    { name = "fastapi", specifier = "==0.128.8" },
+    { name = "fastapi", specifier = "==0.141.1" },
     { name = "psycopg", extras = ["binary"], specifier = "==3.3.4" },
     { name = "pyjwt", specifier = "==2.13.0" },
     { name = "python-dotenv", specifier = "==1.2.2" },
@@ -292,9 +292,9 @@ requires-dist = [
 dev = [
     { name = "httpx", specifier = "==0.28.1" },
     { name = "mypy", specifier = "==2.3.0" },
-    { name = "pytest", specifier = "==9.0.1" },
-    { name = "ruff", specifier = "==0.15.1" },
-    { name = "uvicorn", specifier = "==0.39.0" },
+    { name = "pytest", specifier = "==9.1.1" },
+    { name = "ruff", specifier = "==0.16.3" },
+    { name = "uvicorn", specifier = "==0.52.3" },
 ]
 
 [[package]]
@@ -330,7 +330,7 @@ wheels = [
 
 [[package]]
 name = "fastapi"
-version = "0.128.8"
+version = "0.141.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "annotated-doc" },
@@ -339,9 +339,9 @@ dependencies = [
     { name = "typing-extensions" },
     { name = "typing-inspection" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/01/72/0df5c58c954742f31a7054e2dd1143bae0b408b7f36b59b85f928f9b456c/fastapi-0.128.8.tar.gz", hash = "sha256:3171f9f328c4a218f0a8d2ba8310ac3a55d1ee12c28c949650288aee25966007", size = 375523, upload-time = "2026-02-11T15:19:36.69Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/8a/02/91e3416a8fdd715abb903a952a6bec7cdd8d14eed55d415fc8595524c319/fastapi-0.141.1.tar.gz", hash = "sha256:e8822fc40db1e1858054d7a949a888695bc9bdce70139178e33bd2871a453ca1", size = 425799, upload-time = "2026-07-29T17:18:05.568Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/9f/37/37b07e276f8923c69a5df266bfcb5bac4ba8b55dfe4a126720f8c48681d1/fastapi-0.128.8-py3-none-any.whl", hash = "sha256:5618f492d0fe973a778f8fec97723f598aa9deee495040a8d51aaf3cf123ecf1", size = 103630, upload-time = "2026-02-11T15:19:35.209Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/03/10388a42375ee7e4ac9b94eb2c5c569c8b5795e377e701c9ac3ad63de890/fastapi-0.141.1-py3-none-any.whl", hash = "sha256:bfb91aa2d334c61cb35ba9a116fc123b3d3df31640b801cf57a7a78ec3f603b3", size = 131954, upload-time = "2026-07-29T17:18:04.364Z" },
 ]
 
 [[package]]
@@ -816,7 +816,7 @@ wheels = [
 
 [[package]]
 name = "pytest"
-version = "9.0.1"
+version = "9.1.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
@@ -825,9 +825,9 @@ dependencies = [
     { name = "pluggy" },
     { name = "pygments" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/07/56/f013048ac4bc4c1d9be45afd4ab209ea62822fb1598f40687e6bf45dcea4/pytest-9.0.1.tar.gz", hash = "sha256:3e9c069ea73583e255c3b21cf46b8d3c56f6e3a1a8f6da94ccb0fcf57b9d73c8", size = 1564125, upload-time = "2025-11-12T13:05:09.333Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e4/47/b9efed96c114afcfa3c9d3fe98a76a1d14c74a9e266d397cf6eb64be5e01/pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313", size = 1636369, upload-time = "2026-06-19T10:58:32.857Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0b/8b/6300fb80f858cda1c51ffa17075df5d846757081d11ab4aa35cef9e6258b/pytest-9.0.1-py3-none-any.whl", hash = "sha256:67be0030d194df2dfa7b556f2e56fb3c3315bd5c8822c6951162b92b32ce7dad", size = 373668, upload-time = "2025-11-12T13:05:07.379Z" },
+    { url = "https://files.pythonhosted.org/packages/24/25/1de2678b631f5a49215c6c96fff41ba892b0a34df68d6d80292b1b48aa7f/pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c", size = 386536, upload-time = "2026-06-19T10:58:31.347Z" },
 ]
 
 [[package]]
@@ -841,27 +841,27 @@ wheels = [
 
 [[package]]
 name = "ruff"
-version = "0.15.1"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/04/dc/4e6ac71b511b141cf626357a3946679abeba4cf67bc7cc5a17920f31e10d/ruff-0.15.1.tar.gz", hash = "sha256:c590fe13fb57c97141ae975c03a1aedb3d3156030cabd740d6ff0b0d601e203f", size = 4540855, upload-time = "2026-02-12T23:09:09.998Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/23/bf/e6e4324238c17f9d9120a9d60aa99a7daaa21204c07fcd84e2ef03bb5fd1/ruff-0.15.1-py3-none-linux_armv6l.whl", hash = "sha256:b101ed7cf4615bda6ffe65bdb59f964e9f4a0d3f85cbf0e54f0ab76d7b90228a", size = 10367819, upload-time = "2026-02-12T23:09:03.598Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/ea/c8f89d32e7912269d38c58f3649e453ac32c528f93bb7f4219258be2e7ed/ruff-0.15.1-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:939c995e9277e63ea632cc8d3fae17aa758526f49a9a850d2e7e758bfef46602", size = 10798618, upload-time = "2026-02-12T23:09:22.928Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/0f/1d0d88bc862624247d82c20c10d4c0f6bb2f346559d8af281674cf327f15/ruff-0.15.1-py3-none-macosx_11_0_arm64.whl", hash = "sha256:1d83466455fdefe60b8d9c8df81d3c1bbb2115cede53549d3b522ce2bc703899", size = 10148518, upload-time = "2026-02-12T23:08:58.339Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/c8/291c49cefaa4a9248e986256df2ade7add79388fe179e0691be06fae6f37/ruff-0.15.1-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a9457e3c3291024866222b96108ab2d8265b477e5b1534c7ddb1810904858d16", size = 10518811, upload-time = "2026-02-12T23:09:31.865Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/1a/f5707440e5ae43ffa5365cac8bbb91e9665f4a883f560893829cf16a606b/ruff-0.15.1-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:92c92b003e9d4f7fbd33b1867bb15a1b785b1735069108dfc23821ba045b29bc", size = 10196169, upload-time = "2026-02-12T23:09:17.306Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/ff/26ddc8c4da04c8fd3ee65a89c9fb99eaa5c30394269d424461467be2271f/ruff-0.15.1-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1fe5c41ab43e3a06778844c586251eb5a510f67125427625f9eb2b9526535779", size = 10990491, upload-time = "2026-02-12T23:09:25.503Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/00/50920cb385b89413f7cdb4bb9bc8fc59c1b0f30028d8bccc294189a54955/ruff-0.15.1-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:66a6dd6df4d80dc382c6484f8ce1bcceb55c32e9f27a8b94c32f6c7331bf14fb", size = 11843280, upload-time = "2026-02-12T23:09:19.88Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/6d/2f5cad8380caf5632a15460c323ae326f1e1a2b5b90a6ee7519017a017ca/ruff-0.15.1-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6a4a42cbb8af0bda9bcd7606b064d7c0bc311a88d141d02f78920be6acb5aa83", size = 11274336, upload-time = "2026-02-12T23:09:14.907Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/1d/5f56cae1d6c40b8a318513599b35ea4b075d7dc1cd1d04449578c29d1d75/ruff-0.15.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4ab064052c31dddada35079901592dfba2e05f5b1e43af3954aafcbc1096a5b2", size = 11137288, upload-time = "2026-02-12T23:09:07.475Z" },
-    { url = "https://files.pythonhosted.org/packages/cd/20/6f8d7d8f768c93b0382b33b9306b3b999918816da46537d5a61635514635/ruff-0.15.1-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:5631c940fe9fe91f817a4c2ea4e81f47bee3ca4aa646134a24374f3c19ad9454", size = 11070681, upload-time = "2026-02-12T23:08:55.43Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/67/d640ac76069f64cdea59dba02af2e00b1fa30e2103c7f8d049c0cff4cafd/ruff-0.15.1-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:68138a4ba184b4691ccdc39f7795c66b3c68160c586519e7e8444cf5a53e1b4c", size = 10486401, upload-time = "2026-02-12T23:09:27.927Z" },
-    { url = "https://files.pythonhosted.org/packages/65/3d/e1429f64a3ff89297497916b88c32a5cc88eeca7e9c787072d0e7f1d3e1e/ruff-0.15.1-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:518f9af03bfc33c03bdb4cb63fabc935341bb7f54af500f92ac309ecfbba6330", size = 10197452, upload-time = "2026-02-12T23:09:12.147Z" },
-    { url = "https://files.pythonhosted.org/packages/78/83/e2c3bade17dad63bf1e1c2ffaf11490603b760be149e1419b07049b36ef2/ruff-0.15.1-py3-none-musllinux_1_2_i686.whl", hash = "sha256:da79f4d6a826caaea95de0237a67e33b81e6ec2e25fc7e1993a4015dffca7c61", size = 10693900, upload-time = "2026-02-12T23:09:34.418Z" },
-    { url = "https://files.pythonhosted.org/packages/a1/27/fdc0e11a813e6338e0706e8b39bb7a1d61ea5b36873b351acee7e524a72a/ruff-0.15.1-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:3dd86dccb83cd7d4dcfac303ffc277e6048600dfc22e38158afa208e8bf94a1f", size = 11227302, upload-time = "2026-02-12T23:09:36.536Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/58/ac864a75067dcbd3b95be5ab4eb2b601d7fbc3d3d736a27e391a4f92a5c1/ruff-0.15.1-py3-none-win32.whl", hash = "sha256:660975d9cb49b5d5278b12b03bb9951d554543a90b74ed5d366b20e2c57c2098", size = 10462555, upload-time = "2026-02-12T23:09:29.899Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/5e/d4ccc8a27ecdb78116feac4935dfc39d1304536f4296168f91ed3ec00cd2/ruff-0.15.1-py3-none-win_amd64.whl", hash = "sha256:c820fef9dd5d4172a6570e5721704a96c6679b80cf7be41659ed439653f62336", size = 11599956, upload-time = "2026-02-12T23:09:01.157Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/07/5bda6a85b220c64c65686bc85bd0bbb23b29c62b3a9f9433fa55f17cda93/ruff-0.15.1-py3-none-win_arm64.whl", hash = "sha256:5ff7d5f0f88567850f45081fac8f4ec212be8d0b963e385c3f7d0d2eb4899416", size = 10874604, upload-time = "2026-02-12T23:09:05.515Z" },
+version = "0.16.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/61/b3/3213589383f8f1b3938781bd1278713f6d18621a14992b3e81fefb8a5ef9/ruff-0.16.3.tar.gz", hash = "sha256:e76d33a347661a84b5be6d043d0347fdc745dfdcf825a8f4fed64b5e26eebdf2", size = 4891904, upload-time = "2026-08-13T15:17:13.381Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/bf/96/493770daebd68c0a67f1549fdf519f53be51fc435186c0585bcc272fd76c/ruff-0.16.3-py3-none-linux_armv6l.whl", hash = "sha256:0c5710e247a58a4521e66e124ba9a74655b414f61ba3a2e9e3811e11098f48f7", size = 10902799, upload-time = "2026-08-13T15:16:27.382Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/e6/2becf3942fddc29a29b8df47691d456fb1085391a694f74d84513251418c/ruff-0.16.3-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:fe155130631a2471fd2e14a7a664a4dfbd7194b8229c3d7b2a40b21178639081", size = 11135539, upload-time = "2026-08-13T15:16:30.87Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/1e/4b8b72f0d006dbf19326aa99f9ca0ee2ff374187c4d301cf529a51aa06fe/ruff-0.16.3-py3-none-macosx_11_0_arm64.whl", hash = "sha256:e2ed719e14aa64d895c2ee922594a90a43c861a93f0575a95ff8c47cdbd13eb9", size = 10475095, upload-time = "2026-08-13T15:16:33.259Z" },
+    { url = "https://files.pythonhosted.org/packages/92/32/2201fa49ba1f6c101ee321e83f051ac7a4b8d07b0ef6b4d3f2772b302275/ruff-0.16.3-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9e0b1da805eb043654645d74d5de1e5ce2edc686e40790d2b86f56d71cc06a84", size = 10668771, upload-time = "2026-08-13T15:16:35.65Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/66/4afc5c8363bd04d45effce1b7c8713ca037d7a6740b7451a2403a6e3a972/ruff-0.16.3-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:a37bdea0bbe21780f590bf437d6412c8c4e1b6cd010f91a65c2c40c5e5f5f870", size = 10699568, upload-time = "2026-08-13T15:16:38.195Z" },
+    { url = "https://files.pythonhosted.org/packages/53/fd/c67d246bf36bf1698551c56de39e95cd07f70e64433e0098e6267d77061b/ruff-0.16.3-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:09571e6d1288ed9be475207a3ac04ada404f1cd898104be0f6ab8d7df438575b", size = 11499365, upload-time = "2026-08-13T15:16:40.623Z" },
+    { url = "https://files.pythonhosted.org/packages/67/0b/00ecbceb99a263af7b12f6f05ac3c92bc47b905e91adc3f207a836e3bc01/ruff-0.16.3-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2c18c5a101eb540010638cc1ff3c84944d3adb3df62b8d98ca8f22ba484d3413", size = 12311728, upload-time = "2026-08-13T15:16:43.564Z" },
+    { url = "https://files.pythonhosted.org/packages/54/b2/b7b3bb54f4d3f7db504e476ad4ab8de530dceebe2c061384b2757ee419e8/ruff-0.16.3-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:8457c44f15033c85ddbb77b15d451df9e24e4bd03b628396dd3610cedc3b8f82", size = 11699896, upload-time = "2026-08-13T15:16:46.209Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/30/4c468429ac195addc5ee1b717b6ab1b66632786737ca3b2ed3443fb0c26a/ruff-0.16.3-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:294b95c4ae0cda9388525c2047778aa758d6b8d4bb876fd4e9eaa3ebc92343eb", size = 11058736, upload-time = "2026-08-13T15:16:48.823Z" },
+    { url = "https://files.pythonhosted.org/packages/43/67/7a113cdaddf24b64d7f75b1242a99d04c82fcef4f6921fdbb832beaffb5f/ruff-0.16.3-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:3d0c7c40c87c2a820509c31ba007968da6e1306468c067b2d82fbfdbcd0e8474", size = 11586911, upload-time = "2026-08-13T15:16:51.913Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/c1/2e66f24c0f3ead25a5e660111778685e505e5da353c82802bf49f0cbe7b9/ruff-0.16.3-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:9f738c0fdfa8eed0b2ce7fb27ee7258208a92a68d7949e62aa15164bc7b389da", size = 10954265, upload-time = "2026-08-13T15:16:54.763Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/ba/4cee23bf52cba9a058d3726de623624daf50ef9638868edd86f4126157f6/ruff-0.16.3-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:fb785f0be25abe69d320415cd4f833b59e17ba7613d9ba6a958023b6bceb0a50", size = 10709886, upload-time = "2026-08-13T15:16:57.339Z" },
+    { url = "https://files.pythonhosted.org/packages/82/df/7da7194fa5d9dc0a285f7e6fa5a4722e7c63faac0b45b614ded9314363a1/ruff-0.16.3-py3-none-musllinux_1_2_i686.whl", hash = "sha256:c5536e3acfbf9563085aa2be7b13c629c3077e902afc5b941ac44024dbb9f506", size = 11210392, upload-time = "2026-08-13T15:17:00.171Z" },
+    { url = "https://files.pythonhosted.org/packages/35/85/7795f6e817af050e7517bf3e7aa9b061cce70ef33d280aad902c956c1ecf/ruff-0.16.3-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:a2d85c02f9b8e165d85e6779184d38c4132de12603dab59c51c28e22584f9e4d", size = 11626910, upload-time = "2026-08-13T15:17:03.299Z" },
+    { url = "https://files.pythonhosted.org/packages/78/9b/475b927cf27a5cbbda3c7bafb69ed6ff77e1d7923d5d85f17c2749d7ae32/ruff-0.16.3-py3-none-win32.whl", hash = "sha256:388cdf2166642bd9b13d52b5932d3170f34f8abed7e8d9a855f1d84b83645a0a", size = 10931415, upload-time = "2026-08-13T15:17:05.726Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/99/e2a2bfc4fbf0a1e8a916bc9ebe6fe6c58cc34c28e0ffc6ce281d572d1c2e/ruff-0.16.3-py3-none-win_amd64.whl", hash = "sha256:e80a7d69ca2a6d1c4d352ec91458cdca6e56c83cdbcabd93e4abe1e53591d948", size = 11445993, upload-time = "2026-08-13T15:17:08.353Z" },
+    { url = "https://files.pythonhosted.org/packages/69/3e/4132e539aed78c148854d4997a2685b0ed4dc4e87110b59ce528564e184e/ruff-0.16.3-py3-none-win_arm64.whl", hash = "sha256:b8ca152da82c1acc1fa8d5874b15951935f0eef46f10e6954c83859011b6178a", size = 11399302, upload-time = "2026-08-13T15:17:10.908Z" },
 ]
 
 [[package]]
@@ -894,14 +894,14 @@ wheels = [
 
 [[package]]
 name = "starlette"
-version = "0.52.1"
+version = "1.6.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c4/68/79977123bb7be889ad680d79a40f339082c1978b5cfcf62c2d8d196873ac/starlette-0.52.1.tar.gz", hash = "sha256:834edd1b0a23167694292e94f597773bc3f89f362be6effee198165a35d62933", size = 2653702, upload-time = "2026-01-18T13:34:11.062Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/b5/b4/205b0d5241d934e8add0c38aa924c4f9fb7330834ff11e5444db964ec3f9/starlette-1.6.0.tar.gz", hash = "sha256:d4e3ac5e546444960c710297a3c9fc3f7ebae1b7e963f3d36173b49da535be9b", size = 2716969, upload-time = "2026-08-08T18:27:57.512Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/81/0d/13d1d239a25cbfb19e740db83143e95c772a1fe10202dda4b76792b114dd/starlette-0.52.1-py3-none-any.whl", hash = "sha256:0029d43eb3d273bc4f83a08720b4912ea4b071087a3b48db01b7c839f7954d74", size = 74272, upload-time = "2026-01-18T13:34:09.188Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/cb/6a6a47d5b464bd08695d254f3da6e7986cc70c9fa5d778eda57538edfe56/starlette-1.6.0-py3-none-any.whl", hash = "sha256:a86dd39d14bb45f85a3d18525215a9ef0cfd1f192ac793220e72598c90335f0c", size = 75969, upload-time = "2026-08-08T18:27:56.196Z" },
 ]
 
 [[package]]
@@ -936,13 +936,13 @@ wheels = [
 
 [[package]]
 name = "uvicorn"
-version = "0.39.0"
+version = "0.52.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "click" },
     { name = "h11" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ae/4f/f9fdac7cf6dd79790eb165639b5c452ceeabc7bbabbba4569155470a287d/uvicorn-0.39.0.tar.gz", hash = "sha256:610512b19baa93423d2892d7823741f6d27717b642c8964000d7194dded19302", size = 82001, upload-time = "2025-12-21T13:05:17.973Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/2e/28/64ca011edf31c715b4fad359c587ea52391aaffa125065695590241ff617/uvicorn-0.52.3.tar.gz", hash = "sha256:18857b9e6579300be55c91c0a1cfd37d9a2cf0cabea33b88275f199eb73b8b58", size = 100621, upload-time = "2026-08-13T16:50:02.899Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/6b/25/db2b1c6c35bf22e17fe5412d2ee5d3fd7a20d07ebc9dac8b58f7db2e23a0/uvicorn-0.39.0-py3-none-any.whl", hash = "sha256:7beec21bd2693562b386285b188a7963b06853c0d006302b3e4cfed950c9929a", size = 68491, upload-time = "2025-12-21T13:05:16.291Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/2b/ebd108734a8204c6b4b93c681c9a38c5273b3ccd5d129fee4ffc1d97772c/uvicorn-0.52.3-py3-none-any.whl", hash = "sha256:116af2710dbf47c80f463cd20ee4884b6662f4c9f227d797ddc7279d2fcc2c7c", size = 79859, upload-time = "2026-08-13T16:50:01.323Z" },
 ]
diff --git a/vercel.json b/vercel.json
index 3e0de56..483b066 100644
--- a/vercel.json
+++ b/vercel.json
@@ -6,5 +6,29 @@
   "rewrites": [
     { "source": "/api/(.*)", "destination": "/api/index" },
     { "source": "/((?!api/).*)", "destination": "/index.html" }
+  ],
+  "headers": [
+    {
+      "source": "/(.*)",
+      "headers": [
+        { "key": "X-Content-Type-Options", "value": "nosniff" },
+        { "key": "Referrer-Policy", "value": "no-referrer" },
+        { "key": "X-Frame-Options", "value": "DENY" },
+        { "key": "Cross-Origin-Opener-Policy", "value": "same-origin" },
+        {
+          "key": "Permissions-Policy",
+          "value": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), bluetooth=(), midi=(), display-capture=(), idle-detection=()"
+        }
+      ]
+    },
+    {
+      "source": "/((?!api/).*)",
+      "headers": [
+        {
+          "key": "Content-Security-Policy",
+          "value": "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests"
+        }
+      ]
+    }
   ]
 }
diff --git a/web/vite.config.ts b/web/vite.config.ts
index bbe2381..49b47b9 100644
--- a/web/vite.config.ts
+++ b/web/vite.config.ts
@@ -1,6 +1,37 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
 import react from '@vitejs/plugin-react';
 import { defineConfig } from 'vite';
 
+/**
+ * The production document headers, read out of `vercel.json` rather than copied, so
+ * `vite preview` cannot drift from what the CDN sends. Throws instead of falling back:
+ * a silently header-less preview is the false negative this exists to prevent.
+ */
+function productionHeaders(): Record<string, string> {
+  // The `source` patterns from vercel.json that a document response matches.
+  const documentSources = ['/(.*)', '/((?!api/).*)'];
+
+  const configPath = fileURLToPath(new URL('../vercel.json', import.meta.url));
+  const config = JSON.parse(readFileSync(configPath, 'utf8')) as {
+    headers?: { source: string; headers: { key: string; value: string }[] }[];
+  };
+
+  const headers: Record<string, string> = {};
+  for (const source of documentSources) {
+    const rule = config.headers?.find((entry) => entry.source === source);
+    if (!rule) {
+      throw new Error(
+        `vercel.json has no headers rule with source "${source}". vite preview mirrors ` +
+          `the production headers from that file; update this list if the sources changed.`,
+      );
+    }
+    for (const { key, value } of rule.headers) headers[key] = value;
+  }
+  return headers;
+}
+
 export default defineConfig({
   plugins: [react()],
   build: { outDir: 'dist', emptyOutDir: true, sourcemap: true },
@@ -9,5 +40,14 @@ export default defineConfig({
     // Local stand-in for Vercel's /api/* rewrite, so the SPA and API share an
     // origin in dev exactly as they do in production.
     proxy: { '/api': { target: 'http://127.0.0.1:8000', changeOrigin: false } },
+    // The production CSP is deliberately NOT applied here: the dev server's inline
+    // client and HMR websocket would need a laxer policy than production's, which would
+    // prove less while looking like coverage. Use `preview` below instead.
+  },
+  preview: {
+    port: 4173,
+    // The real build with the real production headers — run this before pushing anything
+    // that adds a script, font, image host or stylesheet.
+    headers: productionHeaders(),
   },
 });