next.config.mjs sets no Content-Security-Policy or other security headers

[ndii-dev]

There is no headers() function in next.config.mjs configuring CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, or Permissions-Policy. For a wallet application handling (eventually real) financial operations and rendering data from external sources (CoinGecko rates, federation lookups once real), the absence of CSP in particular means any future XSS (see the chart.tsx issue above) has no defense-in-depth backstop.

Definition of done:

• CSP configured with a documented policy (script-src, connect-src covering coingecko.com and the real backend API once wired, etc.)
• Remaining standard security headers set (X-Frame-Options or frame-ancestors, X-Content-Type-Options: nosniff, Referrer-Policy)
• Verified via a response-header assertion test against a running dev server

---

Before opening a PR for this issue, read CONTRIBUTING.md.

This is not a starter-issue. The Definition of done above is the full
acceptance criteria, not a subset to sample from — a PR that addresses part
of it is an unfinished issue, not a smaller one. Your PR must include, in
the PR description itself:

• Root cause / design-decision rationale in your own words — not a restatement of this issue
• Every Definition of done bullet above addressed explicitly, with a one-line note on how
• Evidence the code actually runs: pasted test/build output, a screen recording or before/after screenshots for UI changes, or real (non-mocked) logs for network/contract-facing work
• New or updated tests included and shown passing (paste the output)
• Any adjacent/related behavior this issue calls out re-verified, not assumed unaffected

PRs missing these will be sent back before review, not reviewed and rejected — please do this up front.

[iamb8t0-oss]

Hi i would like to work on this issue

[grantfox-oss]

🦊 GrantFox — @iamb8t0-oss has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #82)
2. Your PR will be reviewed by the Orbit-Wal maintainers

Good luck! Track your progress on GrantFox.