[acesonic7]

Stacked on #18; merge that one first.

Summary

Security

• Security headers on every response (next.config.mjs):
  • Content-Security-Policy: same-origin scripts, plus inline ones for Next's bootstrap and the theme script; https/data/blob images; frame-ancestors 'none', object-src 'none', base-uri and form-action set to self. Development also allows eval and websockets for hot reload.
  • X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, X-Frame-Options: DENY, Cross-Origin-Opener-Policy: same-origin and a restrictive Permissions-Policy.
  • X-Powered-By is dropped.
• Push route rate limit (lib/rateLimit.ts): 20 attempts per 10 minutes per client, per serverless instance, answering 429 with Retry-After. Instances don't share memory, so this brakes bursts; a global limit belongs in the Vercel firewall.

Link previews

• app/opengraph-image.tsx: a 1200×630 image (matrix-U logo, tagline, "Free and open source") rendered at build time in Bricolage Grotesque and Instrument Sans.
• Open Graph and Twitter summary_large_image tags, a clearer title and description, keywords, and metadataBase.
• robots.txt (with /api/ disallowed) and sitemap.xml.
• The public address lives in lib/site.ts and can be overridden with NEXT_PUBLIC_SITE_URL when the app moves to its own domain.

Repo

• SECURITY.md, which points to GitHub private vulnerability reporting; CONTRIBUTING.md, including the terminology rule; and CODE_OF_CONDUCT.md, adopting Contributor Covenant 2.1 by reference.
• Issue templates for bugs and feature requests (the bug template asks for browser, version and project file), a security contact link, and a PR template.
• out/ is no longer tracked: its files had the old eu-urban-commute names. The export and preview scripts now create the folder themselves.
• The package is renamed from sp-designer to utilitylab.

Test plan

• npx tsc --noEmit, npm test (1038 passed, 4 new), npm run build
• Production build: all headers present; OG and Twitter tags resolve to the absolute image URL; the image renders correctly; robots.txt and the sitemap are served
• No CSP violations in the browser (production and dev) across:
  • page load and the example;
  • design generation in the worker;
  • the Qualtrics preview iframe and the Studies dialog;
  • an external https image.
• After deploying: check the preview with a link debugger (LinkedIn Post Inspector or opengraph.xyz)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
utilitylab	Ready	Preview	Oct 7, 2026 2:13pm UTC