Katia Bulatova 48d0d4a707 fix(webapp): drop the img-src wildcard host for a validated origin allowlist ...

Replaces https://*.googleusercontent.com (a host with public write access)
with CSP_IMG_SRC_ALLOWLIST: exact origins only, https outside development,
deduplicated, bad entries warned about instead of failing the boot.

2026-08-06 10:27:58 +00:00

..

supervisor

feat(supervisor): cancel a resumed run's in-flight checkpoint (#4502)

2026-08-05 12:01:14 +01:00

webapp

fix(webapp): drop the img-src wildcard host for a validated origin allowlist

2026-08-06 10:27:58 +00:00