From 515a0710e3eb714a3c0422518310cf4485b4bd9f Mon Sep 17 00:00:00 2001
From: Dev M <devtechedge@gmail.com>
Date: Sun, 6 Sep 2026 07:48:32 +0530
Subject: [PATCH] chore(security): harden public surface (2026-09-06)

---
 SECURITY.md    | 10 +++++++++-
 next.config.ts | 24 ++++++++++++++++++++++++
 vercel.json    | 37 +++++++++++++++++++++++++++++++++++++
 3 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 vercel.json

diff --git a/SECURITY.md b/SECURITY.md
index 162c455..88ba414 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,6 +1,6 @@
 # Security Assessment — Luxe Tracker
 
-**Date:** 2026-08-21  
+**Date:** 2026-09-06  
 **Scope:** Auth, XSS, injection, localStorage hardening, dependency risk, secrets hygiene, build config  
 **Context:** Public deploy is a **pure client-side demo** ([luxe-disparity-tracker.vercel.app](https://luxe-disparity-tracker.vercel.app/)). No API routes, no database, no environment variables.
 
@@ -155,3 +155,11 @@ bun run audit
 ```
 
 To report a vulnerability, open a [GitHub security advisory](https://github.com/devtechedge/luxe-tracker/security/advisories) or an issue. There are no production secrets to rotate.
+
+## Repository visibility
+
+This repository is currently **public** for portfolio review. When the open-source
+build story is no longer needed, **the GitHub repo will go private**. Making the
+repo private reduces source disclosure; it does **not** replace strong production
+secrets, auth allow-lists, webhook signatures, or Vercel/Actions environment
+hygiene. Rotate any credential that was pasted into chat, tickets, or screenshots.
diff --git a/next.config.ts b/next.config.ts
index bb1c766..664de49 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -6,7 +6,31 @@ const nextConfig: NextConfig = {
   reactStrictMode: false,
   typescript: {
     ignoreBuildErrors: false,
+  },,
+
+  async headers() {
+    return [
+      {
+        source: "/:path*",
+        headers: [
+          { key: "X-Frame-Options", value: "DENY" },
+          { key: "X-Content-Type-Options", value: "nosniff" },
+          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+          {
+            key: "Permissions-Policy",
+            value: "camera=(), microphone=(), geolocation=(), payment=(), usb=()",
+          },
+          {
+            key: "Strict-Transport-Security",
+            value: "max-age=63072000; includeSubDomains; preload",
+          },
+          { key: "Cross-Origin-Opener-Policy", value: "same-origin" },
+          { key: "X-DNS-Prefetch-Control", value: "off" },
+        ],
+      },
+    ];
   },
+
 }
 
 export default nextConfig
diff --git a/vercel.json b/vercel.json
new file mode 100644
index 0000000..e276a8e
--- /dev/null
+++ b/vercel.json
@@ -0,0 +1,37 @@
+{
+  "headers": [
+    {
+      "source": "/(.*)",
+      "headers": [
+        {
+          "key": "X-Frame-Options",
+          "value": "DENY"
+        },
+        {
+          "key": "X-Content-Type-Options",
+          "value": "nosniff"
+        },
+        {
+          "key": "Referrer-Policy",
+          "value": "strict-origin-when-cross-origin"
+        },
+        {
+          "key": "Permissions-Policy",
+          "value": "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
+        },
+        {
+          "key": "Strict-Transport-Security",
+          "value": "max-age=63072000; includeSubDomains; preload"
+        },
+        {
+          "key": "Cross-Origin-Opener-Policy",
+          "value": "same-origin"
+        },
+        {
+          "key": "X-DNS-Prefetch-Control",
+          "value": "off"
+        }
+      ]
+    }
+  ]
+}