[Programcode]

Outcome

Allows Sentry Replay's privacy-masked compression worker without allowing blob scripts or weakening the rest of the production CSP.

Changes

• add worker-src 'self' blob: to the synchronized Vercel and nginx CSPs
• assert that blob workers are allowed and blob scripts remain forbidden
• retain exact Vercel/nginx CSP parity coverage

Verification

• deployment config tests: 17 passed
• lint and typecheck passed
• production build passed
• nginx configuration syntax passed in nginx:alpine
• parent release gate: 94 files / 957 coverage tests and 124 desktop/mobile Playwright tests passed
• two independent Luna/xhigh reviews found no actionable issues

Live reproduction

Production emitted a CSP error for a Sentry Replay blob worker because worker-src was absent and Chrome fell back to script-src. The new directive is scoped to workers; script-src still excludes blob:.

CI note

GitHub Actions currently cannot allocate runners because the account is out of Actions minutes. Local current-head checks cover this three-file CSP change; Vercel preview will provide the real browser verification.

Summary by CodeRabbit

• Bug Fixes

  • Improved Content Security Policy compatibility for same-origin and blob-based workers.
  • Continued blocking blob-based scripts to preserve security protections.

• Tests

  • Added regression coverage to verify the updated worker and script security policies.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
debate-navigator	Ready	Preview	Aug 31, 2026 6:10pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5e8c694a-50a2-4a57-92fc-23d95a66e563

📥 Commits

Reviewing files that changed from the base of the PR and between 4828c68 and b2985bd.

📒 Files selected for processing (3)

• nginx.conf
• src/test/vercel-deployment-config.test.ts
• vercel.json

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

The deployment Content-Security-Policy now allows same-origin and blob: workers. Regression tests verify the new worker-src directive and confirm that script-src does not allow blob:.

Changes

Worker CSP policy

Layer / File(s)	Summary
Worker CSP contract and validation nginx.conf, vercel.json, src/test/vercel-deployment-config.test.ts	The CSP allows same-origin and blob: workers. Tests verify worker-src 'self' blob: and reject blob: in script-src.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to b2985

The PR narrowly permits Sentry Replay workers while keeping blob scripts forbidden and preserving Vercel/nginx CSP parity. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: allowing Sentry Replay workers through the Content-Security-Policy.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}