fix: set frame-ancestors 'none' to prevent embedding

[danielroe]

🔗 Linked issue

🧭 Context

disables embedding using frame-ancestors

📚 Description

noticed that it was possible to embed npmx.dev in a slidev presentation - this aims to harden things by adding an additional csp

edit - this was based on an out-of-date experience! #2075 already fixes this, but unsure if we still want to add frame-ancestors as boot-and-braces?

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ready	Preview	Aug 6, 2026 1:31pm
npmx.dev	Ready	Preview	Aug 6, 2026 1:31pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
npmx-lunaria	Ignored		Aug 6, 2026 1:31pm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2c119387-3ef5-4efe-a186-b9eff5ebfaa7

📥 Commits

Reviewing files that changed from the base of the PR and between 3eff797 and 0900ea4.

📒 Files selected for processing (1)

• modules/security-headers.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• modules/security-headers.ts

---

📝 Walkthrough

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Improved security headers to enforce frame-ancestor policies through response headers.
  • Strengthened Content Security Policy protection for application pages, API responses and Nuxt DevTools routes.
  • Added appropriate allowances for DevTools during local development while maintaining protection elsewhere.

• Tests

  • Expanded automated coverage to verify CSP response headers and DevTools-specific security behaviour.

Walkthrough

The security headers module adds global and Nuxt devtools route-specific Content-Security-Policy response headers for frame-ancestors. Documentation, unit tests, and end-to-end tests now verify these policies.

Changes

CSP frame-ancestors response headers

Layer / File(s)	Summary
Define frame-ancestors response policies modules/security-headers.ts	Documentation now states that frame-ancestors is delivered through response headers. Global routes use frame-ancestors 'none'. Nuxt devtools routes use frame-ancestors 'self'.
Validate route response headers test/unit/modules/security-headers.spec.ts, test/e2e/security-headers.spec.ts	Unit tests verify the default and devtools route policies. End-to-end tests verify the global policy on HTML page and API responses.

Suggested reviewers: serhalp

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: adding frame-ancestors 'none' to prevent embedding.
Description check	✅ Passed	The description explains that the change adds frame-ancestors to strengthen CSP and prevent embedding.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/frame-ancestors

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[43081j]

Probably still nice to have I think 👍