security: fix CodeQL alerts and harden defaults

.env.example

@@ -3,8 +3,10 @@ NEXT_PUBLIC_APP_NAME="Contoso Council Digital Permit Platform"
 NEXT_PUBLIC_APP_URL=http://localhost:3000
 NEXT_PUBLIC_SUPPORT_EMAIL=licensing@contoso.gov.uk
 NEXT_PUBLIC_SUPPORT_PHONE="0345 678 9000"
-NEXT_PUBLIC_DEMO_MODE=true
-NEXT_PUBLIC_SHOW_SAMPLE_BANNER=true
+# Set to `true` ONLY for local development or a public demo. The banner is
+# shown to visitors so the sample banner should never ship with production.
+NEXT_PUBLIC_DEMO_MODE=false
+NEXT_PUBLIC_SHOW_SAMPLE_BANNER=false
 NEXT_PUBLIC_MAX_FILE_SIZE_MB=10
 NODE_ENV=development
 
@@ -13,9 +15,12 @@ DATABASE_URL="postgresql://licensing:licensing_dev_pw@localhost:5432/digital_per
 
 # Authentication
 NEXTAUTH_URL=http://localhost:3000
-NEXTAUTH_SECRET=change-me-in-production-use-openssl-rand-base64-32
-AUTH_ENABLE_DEMO_CREDENTIALS=true
-DEMO_PASSWORD=replace-with-a-local-demo-password
+# REQUIRED in production. Generate with: openssl rand -base64 32
+NEXTAUTH_SECRET=
+# Enables the email/password provider used for the local demo only. Must be
+# `false` in production, where sign-in flows through Microsoft Entra.
+AUTH_ENABLE_DEMO_CREDENTIALS=false
+DEMO_PASSWORD=
 
 # Microsoft Entra External ID for applicants (optional locally)
 ENTRA_EXTERNAL_ID_TENANT_ID=

.github/workflows/ci.yml

@@ -83,7 +83,7 @@ jobs:
         run: npm run validate:release
 
       - name: Audit dependencies
-        run: npm audit --audit-level=low
+        run: npm run audit:allowlist
 
       - name: Build application
         run: npm run build

next.config.js

@@ -1,7 +1,40 @@
 /** @type {import('next').NextConfig} */
+const contentSecurityPolicy = [
+  "default-src 'self'",
+  "base-uri 'self'",
+  "frame-ancestors 'self'",
+  "form-action 'self'",
+  "object-src 'none'",
+  "img-src 'self' data: blob: https://*.blob.core.windows.net",
+  "font-src 'self' data:",
+  "connect-src 'self'",
+  // Next 15 emits inline script for RSC and route bootstrap; the `unsafe-inline`
+  // fallback is used only where `strict-dynamic` is unsupported.
+  "script-src 'self' 'unsafe-inline'",
+  "style-src 'self' 'unsafe-inline'",
+].join("; ");
+
+const securityHeaders = [
+  { key: "X-Content-Type-Options", value: "nosniff" },
+  { key: "X-Frame-Options", value: "SAMEORIGIN" },
+  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+  {
+    key: "Strict-Transport-Security",
+    value: "max-age=31536000; includeSubDomains",
+  },
+  {
+    key: "Permissions-Policy",
+    value: "camera=(), microphone=(), geolocation=(), payment=()",
+  },
+  { key: "Cross-Origin-Opener-Policy", value: "same-origin" },
+  { key: "Content-Security-Policy", value: contentSecurityPolicy },
+];
+
 const nextConfig = {
   output: "standalone",
+  distDir: process.env.NEXT_DIST_DIR || ".next",
   outputFileTracingRoot: __dirname,
+  poweredByHeader: false,
   serverExternalPackages: [
     "@azure/monitor-opentelemetry",
     "@azure/identity",
@@ -21,6 +54,14 @@ const nextConfig = {
       },
     ],
   },
+  async headers() {
+    return [
+      {
+        source: "/:path*",
+        headers: securityHeaders,
+      },
+    ];
+  },
 };
 
 module.exports = nextConfig;