[P2] Prevent cross-origin framing of the deployed app #220

Priority

P2 ? the public stateful app can be embedded for UI-redress attacks against destructive and authenticated actions.

Finding

The HTML meta CSP has no frame-ancestors; that directive would not be enforceable from a meta policy anyway. The authoritative GitHub Pages response was checked on 2026-08-10 and contains neither an HTTP Content-Security-Policy header nor X-Frame-Options.

An attacker can therefore frame the application cross-origin and use visual overlays to induce clicks on state-consuming controls such as Finish Voyage or on automatic/manual submission controls after the user enters the private key. Same-origin policy prevents direct key/localStorage reads, but it does not prevent clickjacking.

Acceptance criteria

• Serve Content-Security-Policy: frame-ancestors 'none' as an HTTP response header.
• Prefer also serving X-Frame-Options: DENY for legacy coverage.
• If GitHub Pages cannot emit these headers, move or proxy the app through a header-capable host.
• Add an external-origin iframe test that expects embedding to be refused.
• Gate deployment on the exact production anti-framing headers.
• Keep reset confirmation and ensure other sensitive actions have an intentional confirmation model.

Evidence

index.html:6-9, .github/workflows/deploy.yml:97-122, src/components/Board.tsx:143-149, src/components/BorderRollResearch.tsx:189-222. Live response: https://alkwer.github.io/one-more-map.github.io/. Security scan: ace7e3dd-f02d-44c8-be61-0364d510b16f.