@nessframework/security

Adds secure defaults to the Vite development and preview servers: clickjacking protection, MIME sniffing protection, opener isolation, a restrictive permissions policy, and a safe referrer policy.

ness add security --dev

ness.config.mjs

import { defineNessConfig } from '@nessframework/router';
import { ness } from '@nessframework/router/vite';
import security from '@nessframework/security';

export default defineNessConfig({
  vite: {
    plugins: [
      ness({
        plugins: [security({ contentSecurityPolicy: "default-src 'self'" })],
      }),
    ],
  },
});

Set production response headers in the server section of ness.config.mjs; this plugin protects Vite development and preview traffic.