From b53c69e654e68ebf86bc3b267616497116d4de77 Mon Sep 17 00:00:00 2001
From: Fuwn <contact@fuwn.net>
Date: Mon, 1 Jun 2026 14:31:54 +0000
Subject: fix(security): allow media-src in CSP for external video

Static source sweep found a <video> on the home page (rendered when a
user disables all content sections) sourced from video.twimg.com.
media-src was unset, so it fell back to default-src 'self' and would be
blocked. Add media-src 'self' data: blob: https' (matching img-src).
---
 svelte.config.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/svelte.config.js b/svelte.config.js
index 9ef30e18..f21e40e9 100644
--- a/svelte.config.js
+++ b/svelte.config.js
@@ -30,6 +30,7 @@ const config = {
 					"https://proxy.due.moe",
 				],
 				"img-src": ["self", "data:", "blob:", "https:"],
+				"media-src": ["self", "data:", "blob:", "https:"],
 				"connect-src": ["self", "https:", "ws:", "wss:"],
 				"object-src": ["none"],
 				"base-uri": ["self"],
-- 
cgit v1.2.3