Update proxy.ts

src/proxy.ts

@@ -65,7 +65,13 @@ function buildCsp(): string {
     "default-src 'self'",
     `script-src ${scriptSrc}`,
     "style-src 'self' 'unsafe-inline'",
-    "img-src 'self' data:",
+    // 'https:' (not just 'self' data:) — business logos/cover images are
+    // arbitrary externally-hosted URLs an owner pastes into Business
+    // Settings or the installer (see src/lib/business/branding.ts); there
+    // is no fixed set of allowed hosts to enumerate. Scoped to https: only
+    // (never http:), so this doesn't reopen the door to insecure image
+    // loads generally.
+    "img-src 'self' data: https:",
     "font-src 'self'",
     "connect-src 'self'",
     "worker-src 'self'",