ProductPulse is a read-only demonstration application built on synthetic data. It has:
- No authentication or user accounts
- No forms, write paths, or file uploads
- No backend, database, or third-party API calls
- No cookies, tracking, or analytics
- No secrets, API keys, or environment variables exposed to the browser
All data shown in the UI is fictional and generated by hand for the demo. No real product, customer, or revenue data is represented, collected, or stored.
If you find a security issue in this repository or its deployment, please report it privately:
- Preferred: open a private report via GitHub Security Advisories for this repository.
- Alternatively, open a GitHub issue without technical details and request a private channel.
You can expect an acknowledgment within a few days. Because this is a demo with no user data and no privileged operations, most classes of finding (auth bypass, injection into a data store, privilege escalation) do not apply — but reports about the build pipeline, dependency supply chain, or content injection are welcome.
Only the latest deployment from main (productpulse-fpl.vercel.app) is supported.
Every route is served with the following headers (configured in next.config.ts):
| Header | Value |
|---|---|
Content-Security-Policy |
default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'none' |
X-Frame-Options |
DENY |
X-Content-Type-Options |
nosniff |
Referrer-Policy |
strict-origin-when-cross-origin |
Permissions-Policy |
camera=(), microphone=(), geolocation=() |
'unsafe-inline' is required in script-src and style-src: Next.js injects inline bootstrap/hydration scripts, and Recharts (along with Next/Tailwind) emits inline styles. A nonce-based CSP would require middleware, which this static, backend-less demo deliberately avoids. 'unsafe-eval' and wildcard sources are never used; the CSP is otherwise locked to 'self', and framing is denied outright.
Note:
npm run devlogs a console error that React's dev-mode debugging tooling needs'unsafe-eval'. This is development-only — the production bundle contains noeval()calls and the warning is absent from it, so'unsafe-eval'is intentionally not granted. Do not add it to quiet the dev warning.
- postcss
GHSA-qx2v-qp2m-jg93(moderate, XSS via unescaped</style>in stringify output).npm auditreports this transitively inside Next.js's own dependency tree. It is accepted: postcss here is build-time tooling that never processes untrusted input, the site ships as read-only static assets with no runtime CSS generation, and the only available fix is a breaking Next.js downgrade. It will clear when Next bumps its bundled postcss.
A STRIDE analysis of the application lives at docs/threat-model.md.