From 299ec7e17b7db9a96725a508c2bc75ea3e3df3a7 Mon Sep 17 00:00:00 2001
From: sirpiglr <49359077-sirpiglr@users.noreply.replit.com>
Date: Mon, 8 Dec 2025 01:03:11 +0000
Subject: [PATCH] Allow Discord to embed the application activity within its
 interface

Update vercel.json to configure security headers for the activity route, enabling iframe embedding by allowing specific domains and removing restrictive X-Frame-Options.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 9203795e-937a-4306-b81d-b4d5c78c240e
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 6d10562b-5778-4a88-a683-e30823cb4ed5
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/7c94b7a0-29c7-4f2e-94ef-44b2153872b7/9203795e-937a-4306-b81d-b4d5c78c240e/qPXTzuE
Replit-Helium-Checkpoint-Created: true
---
 vercel.json | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/vercel.json b/vercel.json
index 5149f68c..82089f30 100644
--- a/vercel.json
+++ b/vercel.json
@@ -132,6 +132,20 @@
       "source": "/api/(.*)",
       "headers": [{ "key": "Cache-Control", "value": "no-store" }]
     },
+    {
+      "source": "/activity",
+      "headers": [
+        { "key": "X-Content-Type-Options", "value": "nosniff" },
+        {
+          "key": "Referrer-Policy",
+          "value": "strict-origin-when-cross-origin"
+        },
+        {
+          "key": "Content-Security-Policy",
+          "value": "default-src 'self' https: data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: blob: https:; font-src 'self' data: https:; connect-src 'self' https: wss:; frame-ancestors 'self' https://discord.com https://*.discord.com https://*.discordsays.com"
+        }
+      ]
+    },
     {
       "source": "/(.*)",
       "headers": [