Upload app.py with huggingface_hub

app.py

@@ -55,8 +55,8 @@ def apply_security_headers(response):
     response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
     response.headers['X-Content-Type-Options'] = 'nosniff'
     response.headers['X-XSS-Protection'] = '1; mode=block'
-    # Allow framing from truelens.surge.sh by omitting X-Frame-Options DENY
-    response.headers['Content-Security-Policy'] = "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:; img-src 'self' data: blob:; connect-src 'self'; frame-ancestors 'self' https://truelens.surge.sh;"
+    # Allow framing from Hugging Face & Surge, and allow external fonts/styles
+    response.headers['Content-Security-Policy'] = "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: https://fonts.googleapis.com https://fonts.gstatic.com; img-src 'self' data: blob:; connect-src 'self' https://huggingface.co; frame-ancestors 'self' https://truelens.surge.sh https://huggingface.co;"
     response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
     
     # Absolute zero-caching for inference results to maintain privacy