fix(csp): allow Dodo Payments SDK script origin in script-src

[koala73]

Fixes CSP violation reported in Sentry (issue 7368303076).

The Dodo Payments checkout overlay SDK (dodopayments-checkout package) loads its script from https://sdk.custom.hs.dodopayments.com/ which was blocked by our script-src directive.

Changes:

• vercel.json (production): add https://sdk.custom.hs.dodopayments.com to script-src
• index.html (dev/Tauri): same

The checkout frame-src already had checkout.dodopayments.com and test.checkout.dodopayments.com from PR #2024.

Sentry issue marked resolved (inNextRelease).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
worldmonitor	Ignored		Apr 2, 2026 8:45pm

[greptile-apps]

Greptile Summary

This PR fixes a Content Security Policy violation by adding https://sdk.custom.hs.dodopayments.com to the script-src directive in both vercel.json (production HTTP headers) and index.html (dev/Tauri meta tag). This unblocks the Dodo Payments checkout overlay SDK, whose script origin was missing from the allow-list while the frame-src for the checkout iframes was already present.

• vercel.json: Appends https://sdk.custom.hs.dodopayments.com to script-src, keeping the existing connect-src https: wildcard sufficient for API calls the SDK may make.
• index.html: Same addition mirrored for the dev/Tauri environment.
• The fix is narrowly scoped to the exact reported origin rather than using a broader wildcard (e.g., https://*.dodopayments.com), which is good CSP hygiene.
• Pre-existing minor inconsistency: the ordering of https://*.clerk.accounts.dev and https://abacus.worldmonitor.app differs between the two files, but this predates this PR and has no functional impact.

Confidence Score: 4/5

Safe to merge — minimal, targeted CSP change addressing a confirmed Sentry violation with no functional regressions expected.

Both vercel.json and index.html are updated consistently with a narrowly-scoped origin rather than a wildcard. The connect-src wildcard (https:) already covers any API calls the SDK makes, and frame-src already covers the checkout iframe domains. The one point of uncertainty (score not 5) is that the Dodo Payments overlay SDK might dynamically inject additional sub-scripts or stylesheets from other origins at runtime, which could produce further CSP violations not yet observed.

No files require special attention — both changed files are configuration only.

Important Files Changed

Filename	Overview
vercel.json	Appends https://sdk.custom.hs.dodopayments.com to script-src in the production CSP header; change is minimal and correctly scoped.
index.html	Same script-src addition as vercel.json, applied to the dev/Tauri <meta http-equiv="Content-Security-Policy"> tag.

Sequence Diagram

sequenceDiagram
    participant Browser
    participant CSP
    participant DodoSDK as sdk.custom.hs.dodopayments.com
    participant CheckoutFrame as checkout.dodopayments.com

    Browser->>CSP: Load script from sdk.custom.hs.dodopayments.com
    Note over CSP: script-src now includes this origin ✅
    CSP->>DodoSDK: Request allowed
    DodoSDK-->>Browser: dodopayments-checkout SDK bundle

    Browser->>CSP: Open checkout iframe (checkout.dodopayments.com)
    Note over CSP: frame-src already covers this origin ✅
    CSP->>CheckoutFrame: Frame allowed
    CheckoutFrame-->>Browser: Checkout overlay rendered

Loading

_{Reviews (1): Last reviewed commit: "fix(csp): allow Dodo Payments SDK script..." | Re-trigger Greptile}

[greptile-apps]

SDK may need style-src allowance too

The dodopayments-checkout overlay SDK injects a full checkout UI. If it loads any external stylesheets from sdk.custom.hs.dodopayments.com (rather than inlining all styles), those would be blocked by the current style-src 'self' 'unsafe-inline' https://fonts.googleapis.com directive.

The Sentry report only captured the script-src violation, but it's worth keeping an eye on the browser console (or Sentry) after deploying — if the overlay renders without styling or triggers a new CSP report, https://sdk.custom.hs.dodopayments.com may need to be added to style-src as well (and mirrored in index.html).

No action required now, but worth verifying once deployed.