mirror of
https://github.com/penpot/penpot.git
synced 2026-09-01 17:49:08 +00:00
a8ccb5e0cd
Ship both headers from the image so that every deployment starts from a sensible default instead of each installation deriving its own policy. Report-only mode never blocks a request, so this changes no behaviour for existing deployments, and HSTS stays absent unless PENPOT_PUBLIC_URI declares an https scheme. The policy can be narrow because the frontend already reverse proxies its own external dependencies, so 'self' covers them. What it must permit beyond that comes from the code: 'wasm-unsafe-eval' for the render engine, 'unsafe-inline' styles for the inline style attributes of the UI, and blob:/data: for thumbnails, exports and fonts. Closes #11374 Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net> AI-assisted-by: Claude
Penpot Docs
Penpot documentation website.
Usage
To view this site locally, first set up the environment:
# only if necessary
nvm install
nvm use
corepack enable
pnpm install
And launch a development server:
pnpm start
You can then point a browser to http://localhost:8080.
Tooling
- Eleventy (11ty)
- Diagrams with plantuml. See also real-world-plantuml.
- Diagrams with svgbob and mermaid.
- arc42 template.
- c4model for software architecture, and an implementation in plantuml.