- Shipped
- September 23, 2026 at 11:46 AM UTC
- Author
- Kamo
- Commit
- dda2275
MediaService now serves any attachment outside its safe raster/audio/video list (SVG, HTML, PDF…) with Content-Disposition: attachment, X-Content-Type-Options: nosniff and a sandboxing Content-Security-Policy (mediaservice d8971bc). This relay copied only five headers from the upstream response, so all three were dropped here, on internal.<domain> — where the *** cookie is readable by script — and an uploaded SVG would still render inline and run. They now pass through with the rest. Typecheck: the only tsc errors are the five pre-existing `senderMemberId` / ReplyQuote ones from the local @kamo/chat-core copy, none in this file.