From d932c5b3859ff5be6f4229fc3cd1232ab4bfcdb5 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Sat, 18 Jul 2026 11:34:54 -0300
Subject: [PATCH] vault: tighten public response headers

---
 services/vault/middleware.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/services/vault/middleware.yaml b/services/vault/middleware.yaml
index 15d2575e6..312b9774e 100644
--- a/services/vault/middleware.yaml
+++ b/services/vault/middleware.yaml
@@ -6,6 +6,7 @@ metadata:
   namespace: vault
 spec:
   headers:
+    contentSecurityPolicy: "default-src 'none'; connect-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'unsafe-inline' 'self'; form-action 'none'; frame-ancestors 'none'; font-src 'self'"
     contentTypeNosniff: true
     frameDeny: true
     referrerPolicy: no-referrer
@@ -26,6 +27,8 @@ spec:
       Server: ""
       X-Powered-By: ""
       X-Vault-Cluster: ""
+      X-Vault-Index: ""
+      X-Vault-Known-Leader: ""
       X-Vault-Namespace: ""
 
 ---