From 4e20a8483638cada3285d3a9459494c78511ba40 Mon Sep 17 00:00:00 2001
From: Michael SCHAL <michaelschal@gmail.com>
Date: Fri, 23 Jan 2026 09:44:39 +0100
Subject: [PATCH] fix: allow data: scheme in CSP media-src for tts preview

---
 server/index.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/index.ts b/server/index.ts
index a498976..7525384 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -33,7 +33,7 @@ app.use(helmet({
       imgSrc: ["'self'", "data:", "https:", "blob:"],
       fontSrc: ["'self'", "https://fonts.gstatic.com"],
       connectSrc: ["'self'", "https://graph.facebook.com", "https://openrouter.ai", "https://res.cloudinary.com", "https://freesound.org", "wss:", "ws:"],
-      mediaSrc: ["'self'", "https://cdn.freesound.org", "https:"],
+      mediaSrc: ["'self'", "https://cdn.freesound.org", "https:", "data:"],
     }
   },
   crossOriginEmbedderPolicy: false,