Security Hardening: Removed unused iframe exceptions (Principle of Least Privilege)

webpass/__init__.py

@@ -105,18 +105,16 @@ def create_app():
                 if not session.get('bio_verified'):
                     return redirect(url_for('bio.lock_screen'))
 
+    # 5. SECURITY HEADERS
     # 5. SECURITY HEADERS
     # 5. SECURITY HEADERS
     @app.after_request
     def add_security_headers(response):
         response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
         
-        # The modern, precise way to whitelist specific domains for iframing
-        # 'self' allows your own app, the URLs allow your specific domains
-        response.headers['Content-Security-Policy'] = "frame-ancestors 'self' https://webpass.augsec.in https://huggingface.co;"
-        
-        # Note: We remove X-Frame-Options because CSP frame-ancestors replaces it 
-        # and is fully supported by all modern browsers.
+        # SLAMMING THE DOOR: Removed your custom domain since the Vercel Proxy doesn't need it.
+        # We only allow Hugging Face so your developer portfolio preview still works!
+        response.headers['Content-Security-Policy'] = "frame-ancestors 'self' https://huggingface.co;"
         
         return response