Headers such as X-Frame-Options, X-Content-Type-Options and Permissions-Policy are set by Traefik in front of the container. Caddy or nginx inside the image only serve the static files.
The HTML itself only contains <meta name="referrer" content="strict-origin-when-cross-origin">.
- Templates rely on Angular's sanitization. The only exception is the TeamSpeak viewer URL in the right sidebar, which is trusted as a resource URL for a sandboxed iframe.
securityInterceptorabortshttp://requests when the page runs on HTTPS.- External links open with
rel="noopener noreferrer". - ESLint forbids
eval,new Functionandjavascript:URLs and warns onany.