diff --git a/index.html b/index.html
index 332624c..8329cc6 100644
--- a/index.html
+++ b/index.html
@@ -48,55 +48,10 @@
-
+
diff --git a/public/_headers b/public/_headers
new file mode 100644
index 0000000..63cff23
--- /dev/null
+++ b/public/_headers
@@ -0,0 +1,6 @@
+/*
+ Content-Security-Policy: default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline' https://unpkg.com; img-src 'self' data: blob: https:; font-src 'self' https://fonts.gstatic.com data:; connect-src 'self' https: wss:; media-src 'self' blob: https:; frame-src 'self' https:; worker-src 'self' blob:; manifest-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
+ X-Content-Type-Options: nosniff
+ X-Frame-Options: DENY
+ Referrer-Policy: strict-origin-when-cross-origin
+ Permissions-Policy: geolocation=(self), camera=(self), microphone=()
diff --git a/public/boot-guard.js b/public/boot-guard.js
new file mode 100644
index 0000000..8682db8
--- /dev/null
+++ b/public/boot-guard.js
@@ -0,0 +1,58 @@
+/*
+ BOOT CRASH GUARD (native-safe).
+ Loaded as an external script so the web build can ship a strict
+ Content-Security-Policy (script-src 'self') with no 'unsafe-inline'.
+ Paints any uncaught boot error directly to the screen using inline styles
+ only — so a failure that would otherwise be a silent white screen becomes a
+ readable message on device. If the app boots normally it clears itself.
+*/
+(function () {
+ var shown = false;
+ function paint(kind, err) {
+ if (shown) return;
+ shown = true;
+ try {
+ var msg = (err && (err.stack || err.message)) ? (err.stack || err.message) : String(err);
+ var el = document.createElement('div');
+ el.setAttribute('style', [
+ 'position:fixed', 'inset:0', 'z-index:2147483647',
+ 'background:#000', 'color:#fff', 'padding:20px',
+ 'font:13px/1.5 -apple-system,system-ui,monospace',
+ 'overflow:auto', '-webkit-overflow-scrolling:touch'
+ ].join(';'));
+ var head = document.createElement('div');
+ head.setAttribute('style', 'color:#ff0040;font-weight:700;font-size:16px;margin-bottom:8px');
+ head.textContent = 'SkateSpots failed to start';
+ var sub = document.createElement('div');
+ sub.setAttribute('style', 'color:#9ca3af;margin-bottom:12px');
+ sub.textContent = kind;
+ var pre = document.createElement('pre');
+ pre.setAttribute('style', 'white-space:pre-wrap;word-break:break-word;color:#f3f4f6;margin:0');
+ pre.textContent = msg || '(no message)';
+ var btn = document.createElement('button');
+ btn.setAttribute('style', 'margin-top:16px;padding:10px 16px;background:#ff0040;color:#000;border:0;border-radius:8px;font-weight:700');
+ btn.textContent = 'Reload';
+ btn.addEventListener('click', function () { location.reload(); });
+ el.appendChild(head);
+ el.appendChild(sub);
+ el.appendChild(pre);
+ el.appendChild(btn);
+ document.body.appendChild(el);
+ } catch (e) { /* last resort: nothing we can do */ }
+ }
+ window.addEventListener('error', function (e) {
+ paint('Uncaught error', e.error || e.message);
+ });
+ window.addEventListener('unhandledrejection', function (e) {
+ paint('Unhandled promise rejection', e.reason);
+ });
+ // If nothing has rendered into #root after 12s, surface a hint.
+ setTimeout(function () {
+ var root = document.getElementById('root');
+ if (root && root.childElementCount === 0) {
+ paint('App did not render (timeout)', 'The bundle loaded but nothing mounted within 12s. This usually means a boot-time exception was swallowed.');
+ }
+ }, 12000);
+ // Let the app signal a clean boot to cancel the timeout guard.
+ window.__SKATESPOTS_BOOTED__ = function () { shown = true; };
+})();
diff --git a/src/components/SpotMap.tsx b/src/components/SpotMap.tsx
index 4584199..9a062c4 100644
--- a/src/components/SpotMap.tsx
+++ b/src/components/SpotMap.tsx
@@ -11,6 +11,30 @@ import { SPOT_TYPE_LABELS, formatPrice } from '@/lib/types';
import type { SpotWeatherData } from '@/hooks/useSpotWeather';
import type { BtcMapPlace } from '@/hooks/useBtcMapPlaces';
import { isRecentlyVerified, isBoosted } from '@/hooks/useBtcMapPlaces';
+import { sanitizeUrl } from '@/lib/sanitizeUrl';
+
+/**
+ * SECURITY: Leaflet popups are built as raw DOM, outside React's auto-escaping.
+ * Every value that originates from a Nostr event (spot/tour/crew/event fields)
+ * or a third-party API (BTC Map places) is UNTRUSTED and must never be placed
+ * into `innerHTML`. These helpers build popup rows with `textContent` (which
+ * cannot execute markup) and validate URLs with `sanitizeUrl` before they touch
+ * an `href`/`src`. See .agents/skills/nostr-security.
+ */
+
+/** A popup detail row: an emoji/icon prefix + untrusted text set via textContent. */
+function popupRow(prefix: string, text: string): HTMLElement {
+ const row = document.createElement('div');
+ row.className = 'flex items-center gap-2';
+ const label = document.createElement('span');
+ // Prefix is always a hardcoded emoji/label — safe as textContent too.
+ label.textContent = prefix;
+ const value = document.createElement('span');
+ value.textContent = text; // untrusted — textContent neutralizes any markup
+ row.appendChild(label);
+ row.appendChild(value);
+ return row;
+}
// Fix default marker icon issues with webpack/vite
const defaultIcon = L.icon({
@@ -277,7 +301,12 @@ const createEventIcon = () => L.divIcon({
});
// Custom crew marker icon (teal/cyan — crew home turf)
-const createCrewIcon = (logo?: string) => L.divIcon({
+const createCrewIcon = (logo?: string) => {
+ // SECURITY: crew.image is untrusted. Only embed it when it's a valid http(s)
+ // URL; sanitizeUrl returns a parsed href with quotes percent-encoded, so it
+ // cannot break out of the double-quoted src="" attribute below.
+ const safeLogo = sanitizeUrl(logo);
+ return L.divIcon({
className: 'crew-marker',
html: `