[aigbagbobila]

Summary

This change addresses the deployment, dependency security, user-generated content, and response-header work tracked in issues #688–#691. It adds environment-gated Vercel deployment automation, makes the notification WebSocket configurable per environment, audits dependencies in CI, prevents unsafe HTML rendering, and adds baseline security headers in report-only CSP mode.

Changes

Issue #688 — staging and production environment configuration

• Added a deployment workflow that deploys pushes to staging as Vercel Preview deployments and deploys v* tags to Vercel Production.
• Staging and production are separate GitHub Environments. The workflow reads the API URL, notification WebSocket URL, analytics opt-in, Vercel project identifiers, and deployment token from the selected environment.
• Production deployment is gated by the GitHub production Environment. Repository owners must configure required reviewers and branch/tag restrictions in GitHub settings.
• The notification client now honors VITE_WEBSOCKET_URL, validates that it uses ws: or wss:, and adds the auth token through URL query parameters. When unset, it retains the same-origin endpoint behavior.
• Added deployment setup and rollback instructions in docs/deploy.md, including an explicit note that an owner must verify rollback once the hosting project is configured.
• Documented VITE_ENABLE_ANALYTICS as an environment-specific opt-in, defaulting to false. No analytics provider is enabled by this change.

Issue #689 — dependency updates and vulnerability scanning

• Added weekly grouped Dependabot updates for npm dependencies and GitHub Actions.
• Changed CI dependency setup from npm install to lockfile-respecting npm ci.
• Added npm audit --audit-level=high to CI, so high and critical vulnerabilities fail validation.
• Added a lockfile diff check and an audit exception policy. There are no active audit exceptions; any future exception must include an owner, rationale, controls, and expiry date.

Issue #690 — safe user-generated content rendering

• Confirmed dispute author names and comments are rendered as React text children in DisputeThread, so markup and javascript: text remain inert.
• Added an ESLint restriction that rejects dangerouslySetInnerHTML in TypeScript React files.
• Documented the text-only rendering rule and requirements for any future sanitized rich-text feature.
• No ProfileForm or clickable links in dispute comments exist in this checkout; no unsupported profile/comment-link behavior was introduced.

Issue #691 — CSP and hosting headers

• Added Content-Security-Policy-Report-Only plus Referrer-Policy, X-Content-Type-Options, and X-Frame-Options response headers in vercel.json.
• The CSP denies framing and plugins, restricts scripts to self, and limits connections to self and the documented API/realtime hosts while remaining report-only during rollout.
• Added a rollout guide describing how to review staging reports and switch to enforcement after validating required origins.
• The .example.com API hosts in the initial policy are placeholders and must be replaced with the real staging and production origins before enforcement.

Validation

• Passed git diff --check.
• Passed node --check eslint.config.js.
• Parsed vercel.json and package.json successfully.
• Did not install dependencies or run tests, as requested. node_modules is absent, so local ESLint and build/type checks were not available. CI will run the configured validation after dependencies are installed by the workflow.
• A real staging deployment, browser CSP report review, and rollback exercise require the repository's Vercel project and GitHub Environment configuration and remain operator validation steps.

Required repository setup

1. Create GitHub Environments named staging and production; add the documented variables and VERCEL_TOKEN secret separately to each.
2. Restrict staging to the staging branch; restrict production to v* tags and configure required reviewers.
3. Configure Vercel project access and branch-specific preview values. Keep production credentials out of preview/staging variables.
4. Replace CSP placeholder origins with exact deployed API and WebSocket origins, review report-only violations in staging, then enforce the policy.

Closes #688
Closes #689
Closes #690
Closes #691

[vercel]

Someone is attempting to deploy a commit to the sheriffamina1-9497's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@aigbagbobila Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits