Feat/security audit infinite scroll csp

next.config.ts

@@ -7,11 +7,63 @@ const nextConfig: NextConfig = {
       transform: 'lodash/{{member}}',
     },
   },
-
   eslint: {
     // Many legacy files do not match Prettier; keep type checking without blocking production builds.
     ignoreDuringBuilds: true,
   },
+
+  // ── Asset Versioning & Cache Headers (#326) ──────────────────────────────
+  // Next.js already content-hashes JS/CSS chunks in /_next/static/.
+  // We add long-lived cache headers for those immutable assets and a
+  // short revalidation window for HTML pages so users never see stale UI.
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: [
+          { key: 'X-Frame-Options', value: 'DENY' },
+          { key: 'X-Content-Type-Options', value: 'nosniff' },
+          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+          {
+            key: 'Permissions-Policy',
+            value: 'camera=(), microphone=(), geolocation=(), payment=(), usb=()',
+          },
+          { key: 'X-DNS-Prefetch-Control', value: 'off' },
+        ],
+      },
+      {
+        // Immutable hashed static assets – cache for 1 year
+        source: '/_next/static/:path*',
+        headers: [
+          {
+            key: 'Cache-Control',
+            value: 'public, max-age=31536000, immutable',
+          },
+        ],
+      },
+      {
+        // Public folder assets (images, fonts, etc.) – cache for 7 days
+        source: '/static/:path*',
+        headers: [
+          {
+            key: 'Cache-Control',
+            value: 'public, max-age=604800, stale-while-revalidate=86400',
+          },
+        ],
+      },
+      {
+        // HTML pages – always revalidate so deployments are picked up quickly
+        source: '/:path*',
+        headers: [
+          {
+            key: 'Cache-Control',
+            value: 'public, max-age=0, must-revalidate',
+          },
+        ],
+      },
+    ];
+  },
+
   images: {
     formats: ['image/avif', 'image/webp'],
     deviceSizes: [640, 750, 828, 1080, 1200, 1920, 2048, 3840],