fix: add shapeshift api csp for widget

[firebomb1]

This adds the new URL of the ShapeShift API endpoint to the connect-src context in the CSP. Certain browsers when using ads/script blocking extensions do respect this policy stricly and it prevents them to fetch quotes (Firefox with uMatrix/uBlock).

Chances are this was already an issue before #90, but nobody noticed 😅

Summary by CodeRabbit

• Chores
  • Updated security policy configuration to allow connectivity with an additional API endpoint.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
website-frontend	Ready	Preview, Comment	Jan 27, 2026 1:51pm

[coderabbitai]

📝 Walkthrough

Walkthrough

The CSP header configuration in middleware.ts was updated to include an additional origin (https://api.thorchain.shapeshift.com) in the connect-src directive. No functional logic or control flow was altered.

Changes

Cohort / File(s)	Summary
CSP Header Configuration middleware.ts	Added https://api.thorchain.shapeshift.com to the connect-src directive in the Content Security Policy header

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Suggested reviewers

• 0xApotheosis

Poem

🐰 A rabbit whispers through the net,
A new origin, no regrets!
Thorchain speaks, we shall allow,
Security policies take a bow! 🔐✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding a ShapeShift API endpoint to CSP for the widget, which directly matches the changeset's primary modification.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix-add-shapeshift-api-csp

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[0xApotheosis]

LGTM!