From 4eb93411bb5997d8717543cc6775060978380259 Mon Sep 17 00:00:00 2001
From: Stefan Lazic <s.lazic@edynamix.com>
Date: Tue, 4 Aug 2026 10:13:10 +0100
Subject: [PATCH] Update proxy.ts

---
 src/proxy.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/proxy.ts b/src/proxy.ts
index 588f3a3..ad21066 100644
--- a/src/proxy.ts
+++ b/src/proxy.ts
@@ -65,7 +65,13 @@ function buildCsp(): string {
     "default-src 'self'",
     `script-src ${scriptSrc}`,
     "style-src 'self' 'unsafe-inline'",
-    "img-src 'self' data:",
+    // 'https:' (not just 'self' data:) — business logos/cover images are
+    // arbitrary externally-hosted URLs an owner pastes into Business
+    // Settings or the installer (see src/lib/business/branding.ts); there
+    // is no fixed set of allowed hosts to enumerate. Scoped to https: only
+    // (never http:), so this doesn't reopen the door to insecure image
+    // loads generally.
+    "img-src 'self' data: https:",
     "font-src 'self'",
     "connect-src 'self'",
     "worker-src 'self'",