From f17260aca736e49d34fff20fec32c97b66047bf9 Mon Sep 17 00:00:00 2001
From: John Ferlito <johnf@inodes.org>
Date: Wed, 28 Oct 2026 11:31:34 +1100
Subject: [PATCH 1/2] docs: record ADR 0005 and tell redirect targets to
 protect themselves (#135)

ADR 0005 records that the library sandboxes the bytes it delivers. The Storage page now says
the library can't add headers to a redirect target, and what a redirecting backend or a CDN in
front of S3 should do instead.
---
 .../0005-library-sandboxes-delivered-bytes.md | 59 +++++++++++++++++++
 .../src/content/docs/strategies/storage.mdx   |  9 +++
 2 files changed, 68 insertions(+)
 create mode 100644 docs/adr/0005-library-sandboxes-delivered-bytes.md

diff --git a/docs/adr/0005-library-sandboxes-delivered-bytes.md b/docs/adr/0005-library-sandboxes-delivered-bytes.md
new file mode 100644
index 0000000..54ca8d0
--- /dev/null
+++ b/docs/adr/0005-library-sandboxes-delivered-bytes.md
@@ -0,0 +1,59 @@
+# 5. The library sandboxes the bytes it delivers
+
+Date: 2026-10-28
+
+## Status
+
+Accepted
+
+## Context
+
+Content and much Metadata come from depositors and nobody vets them. The
+library served them on the API's origin under their own Content-Type and with
+no other protective headers. So opening a deposited HTML or SVG file ran its
+scripts on that origin, where they could reach cookies, same-origin pages and
+any sign-in or admin UI the deployment hosts there.
+
+Browsers render inline PDFs, images and text under `Content-Security-Policy:
+sandbox`. That holds in current Chrome and Firefox, and in Safari from 18.4;
+Safari 17.4.1 to 18.3 won't show a PDF under it. Chrome won't play audio or
+video opened directly under `sandbox`, because the media document refetches
+the file from an opaque origin and fails CORS. It also won't play them under
+`default-src 'none'` without `media-src`. A browser can't run script in a
+media document, and `<audio>`/`<video>` elements ignore the media response's
+CSP.
+
+## Decision
+
+Every response the library sends from a `stream`, `path` or `json` delivery,
+for Content and Metadata alike, on GET and HEAD, carries:
+
+- `X-Content-Type-Options: nosniff`
+- unless its Content-Type is `audio/*` or `video/*`:
+  `Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox`
+
+`sandbox` gives the document an opaque origin and blocks its scripts.
+`default-src 'none'` stops a deposited page loading outside images, fonts or
+stylesheets, so it can't pass as a convincing page on the API origin or
+beacon out; inline styles still render. `nosniff` keeps a file labelled as
+media from being sniffed into HTML.
+
+The headers are fixed: there's no plugin option. A deployment that needs
+deposited HTML to run overrides them in its own Fastify `onSend` hook.
+
+Redirect deliveries get none of this, as their headers can't reach the
+target.
+
+## Consequences
+
+- Deposited HTML and SVG still display but run no scripts and load nothing
+  from outside.
+- Opening audio or video directly plays in every browser, with no CSP
+  protecting the media document.
+- Safari before 18.4 downloads or fails to show inline PDFs.
+- A redirect target must protect itself: it should be on an origin that holds
+  no sign-ins, or send the same headers itself. A presigned S3 URL is already
+  on its own origin.
+- Granting `Access-Control-Allow-Origin: *` would also have fixed media under
+  `sandbox`, but it would let any origin's scripts read Content the API
+  serves, so it was rejected.
diff --git a/website/src/content/docs/strategies/storage.mdx b/website/src/content/docs/strategies/storage.mdx
index c9b42bb..711054f 100644
--- a/website/src/content/docs/strategies/storage.mdx
+++ b/website/src/content/docs/strategies/storage.mdx
@@ -107,6 +107,15 @@ When you redirect, plan for:
   so a client that repeats the `HEAD` against `Location` gets `403` from the bucket. To learn the size without the
   body, follow with a `GET` carrying `Range: bytes=0-0` and read the total from `Content-Range`. See
   [#131](https://github.com/crate-works/arocapi/issues/131).
+- **Protecting the target.** arocapi sandboxes the bytes it sends itself
+  ([ADR 0005](https://github.com/crate-works/arocapi/blob/main/docs/adr/0005-library-sandboxes-delivered-bytes.md)),
+  but it can't add headers to a redirect target. Point redirects at an origin that holds no sign-ins, or have the
+  target send `Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox` (except for audio and
+  video) and `X-Content-Type-Options: nosniff` itself. That includes a content route of your own, as in the signed
+  redirect example.
+- **`S3Storage` and a CDN.** A presigned URL is already on the bucket's own origin, separate from the API's. If the
+  bucket sits behind a CDN on the API's site, have the CDN add the headers, for example with a CloudFront response
+  headers policy.
 
 Choose `delivery: 'stream'` when clients can't reach the bucket, such as a store on a private network, or when you
 don't want URLs that outlive the access check. Metadata always streams from S3, whichever you choose.

From 27ff49eb6978c05d60e837aa1e07061e12dccb3e Mon Sep 17 00:00:00 2001
From: John Ferlito <johnf@inodes.org>
Date: Wed, 28 Oct 2026 11:31:43 +1100
Subject: [PATCH 2/2] fix: sandbox the Content and Metadata the library
 delivers (#134)

Deposited HTML and SVG served by the API no longer run scripts or load outside resources.

Every stream, path and json delivery now carries `X-Content-Type-Options: nosniff` and
`Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox`. A single
audio or video Content-Type skips the CSP, as Chrome won't play media opened directly under it.
Redirects are unchanged. A deployment can replace the headers in an onSend hook registered in
arocapi's scope, as the storage configuration docs show.
---
 docs/adr/0004-pluggable-storage-backends.md   |   2 +
 .../0005-library-sandboxes-delivered-bytes.md |  16 +--
 src/routes/file.test.ts                       | 107 +++++++++++++++++-
 src/routes/metadata.test.ts                   |  35 ++++++
 src/storage/deliver.ts                        |   6 +-
 src/test/helpers/protectiveHeaders.ts         |  13 +++
 src/test/helpers/storageApp.ts                |  22 ++--
 src/utils/headers.ts                          |  24 +++-
 .../examples/configuration/storage-headers.ts |  21 ++++
 .../content/docs/configuration/storage.mdx    |  36 ++++++
 .../docs/reference/storage-backend.mdx        |   3 +
 11 files changed, 262 insertions(+), 23 deletions(-)
 create mode 100644 src/test/helpers/protectiveHeaders.ts
 create mode 100644 website/examples/configuration/storage-headers.ts

diff --git a/docs/adr/0004-pluggable-storage-backends.md b/docs/adr/0004-pluggable-storage-backends.md
index 59a1a29..d5338b6 100644
--- a/docs/adr/0004-pluggable-storage-backends.md
+++ b/docs/adr/0004-pluggable-storage-backends.md
@@ -88,6 +88,8 @@ not preclude it.
   so Metadata deliveries carry no `contentType`.
   It sets `Content-Disposition` on `stream` and `path` deliveries; a
   redirecting backend bakes `context.contentDisposition` into its URL.
+- The library also sets protective headers on `stream`, `path` and `json`
+  deliveries; see [ADR 0005](0005-library-sandboxes-delivered-bytes.md).
 - Storage is the source of truth for size, ETag and Last-Modified, so a
   stale `File.size` can't produce a wrong header. `File.mediaType` is the
   source of truth for Content-Type, since stored types are often
diff --git a/docs/adr/0005-library-sandboxes-delivered-bytes.md b/docs/adr/0005-library-sandboxes-delivered-bytes.md
index 54ca8d0..c12877a 100644
--- a/docs/adr/0005-library-sandboxes-delivered-bytes.md
+++ b/docs/adr/0005-library-sandboxes-delivered-bytes.md
@@ -14,9 +14,10 @@ no other protective headers. So opening a deposited HTML or SVG file ran its
 scripts on that origin, where they could reach cookies, same-origin pages and
 any sign-in or admin UI the deployment hosts there.
 
-Browsers render inline PDFs, images and text under `Content-Security-Policy:
-sandbox`. That holds in current Chrome and Firefox, and in Safari from 18.4;
-Safari 17.4.1 to 18.3 won't show a PDF under it. Chrome won't play audio or
+Browsers render inline PDFs, images and text under the full policy
+`default-src 'none'; style-src 'unsafe-inline'; sandbox`. That holds in
+current Chrome and Firefox, and in Safari from 18.4; Safari 17.4.1 to 18.3
+won't show a PDF under `sandbox`. Chrome won't play audio or
 video opened directly under `sandbox`, because the media document refetches
 the file from an opaque origin and fails CORS. It also won't play them under
 `default-src 'none'` without `media-src`. A browser can't run script in a
@@ -29,7 +30,8 @@ Every response the library sends from a `stream`, `path` or `json` delivery,
 for Content and Metadata alike, on GET and HEAD, carries:
 
 - `X-Content-Type-Options: nosniff`
-- unless its Content-Type is `audio/*` or `video/*`:
+- unless its Content-Type is a single `audio/*` or `video/*` type, as a
+  browser reads the last of a comma-separated list:
   `Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox`
 
 `sandbox` gives the document an opaque origin and blocks its scripts.
@@ -47,13 +49,11 @@ target.
 ## Consequences
 
 - Deposited HTML and SVG still display but run no scripts and load nothing
-  from outside.
+  from outside. Images and fonts embedded in them as `data:` URLs are blocked
+  too.
 - Opening audio or video directly plays in every browser, with no CSP
   protecting the media document.
 - Safari before 18.4 downloads or fails to show inline PDFs.
 - A redirect target must protect itself: it should be on an origin that holds
   no sign-ins, or send the same headers itself. A presigned S3 URL is already
   on its own origin.
-- Granting `Access-Control-Allow-Origin: *` would also have fixed media under
-  `sandbox`, but it would let any origin's scripts read Content the API
-  serves, so it was rejected.
diff --git a/src/routes/file.test.ts b/src/routes/file.test.ts
index ce6ca47..d3c6826 100644
--- a/src/routes/file.test.ts
+++ b/src/routes/file.test.ts
@@ -3,12 +3,13 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { Readable } from 'node:stream';
 import type { FastifyInstance } from 'fastify';
-import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import { afterAll, beforeAll, beforeEach, describe, expect, it, onTestFinished, vi } from 'vitest';
 import { mockReset } from 'vitest-mock-extended';
 import type { File } from '../generated/prisma/client.js';
 import type { ContentDelivery, ContentSource, MetadataSource } from '../storage/backend.js';
 import { prisma } from '../test/helpers/fastify.js';
 import { getAndHead } from '../test/helpers/getAndHead.js';
+import { mediaOnly, protectiveHeaders, sandboxed, unprotected } from '../test/helpers/protectiveHeaders.js';
 import { entityRow, fileRow } from '../test/helpers/rows.js';
 import { buildStorageApp } from '../test/helpers/storageApp.js';
 import type { StandardErrorResponse } from '../utils/errors.js';
@@ -142,6 +143,110 @@ describe('File Route', () => {
     });
   });
 
+  describe('protective headers', () => {
+    const withType = (type: 'stream' | 'path', contentType: string): ContentDelivery =>
+      type === 'stream'
+        ? { type, open: () => Readable.from([bytes]), contentType, contentLength: bytes.length }
+        : { type, path: join(dir, 'test.wav'), contentType, contentLength: bytes.length };
+
+    describe.each(['stream', 'path'] as const)('%s delivery', (type) => {
+      it.each([
+        'text/html',
+        'image/svg+xml',
+        'application/pdf',
+        'application/octet-stream',
+        // Browsers take the last type in a list, so these must not pass as media
+        'audio/mpeg, text/html',
+        'audio/mpeg;x=1, text/html',
+        'video/mp4,text/html',
+        ' audio/mpeg',
+        'audio/',
+        'audio/mpeg; x="a", text/html',
+      ])('sandboxes %s on GET and HEAD', async (contentType) => {
+        content.mockImplementation(() => withType(type, contentType));
+
+        const { get, head } = await both();
+
+        for (const response of [get, head]) {
+          expect(response.statusCode).toBe(200);
+          expect(protectiveHeaders(response)).toEqual(sandboxed);
+        }
+      });
+
+      it.each([
+        'audio/wav',
+        'video/mp4',
+        'audio/ogg; codecs=opus',
+        'Video/MP4',
+        'AUDIO/Mpeg;rate=44100',
+        'video/mp4; codecs="avc1.42E01E, mp4a.40.2"',
+        'audio/ogg; codecs="opus,vorbis"',
+      ])('sends %s with nosniff and no CSP on GET and HEAD', async (contentType) => {
+        content.mockImplementation(() => withType(type, contentType));
+
+        const { get, head } = await both();
+
+        for (const response of [get, head]) {
+          expect(response.statusCode).toBe(200);
+          expect(protectiveHeaders(response)).toEqual(mediaOnly);
+        }
+      });
+    });
+
+    it.each(['', '?noRedirect=true'])('adds neither to a redirect delivery when the query is %j', async (query) => {
+      content.mockResolvedValue({ type: 'redirect', url: 'https://storage.example.com/test.html' });
+
+      const { get, head } = await both(query);
+
+      for (const response of [get, head]) {
+        expect(protectiveHeaders(response)).toEqual(unprotected);
+      }
+    });
+
+    it('adds neither to a 404 or a 500', async () => {
+      content.mockResolvedValueOnce(null).mockRejectedValueOnce(new Error('Storage is unreachable'));
+
+      const missing = await app.inject({ method: 'GET', url });
+      const failed = await app.inject({ method: 'GET', url });
+
+      expect(missing.statusCode).toBe(404);
+      expect(failed.statusCode).toBe(500);
+      for (const response of [missing, failed]) {
+        expect(protectiveHeaders(response)).toEqual(unprotected);
+      }
+    });
+
+    it('lets a consumer onSend hook replace the CSP', async () => {
+      const custom = await buildStorageApp({ metadata, content }, (instance) => {
+        instance.addHook('onSend', async (_request, reply, payload) => {
+          if (reply.hasHeader('content-security-policy')) {
+            reply.header('Content-Security-Policy', 'sandbox allow-scripts');
+          }
+          return payload;
+        });
+      });
+      content.mockImplementation(() => withType('stream', 'text/html'));
+
+      onTestFinished(() => custom.app.close());
+
+      const response = await custom.app.inject({ method: 'GET', url });
+
+      expect(protectiveHeaders(response)).toEqual({ csp: 'sandbox allow-scripts', nosniff: 'nosniff' });
+    });
+
+    it('adds neither to the 500 when Last-Modified cannot be set', async () => {
+      content.mockReturnValue({
+        ...withType('stream', 'text/html'),
+        lastModified: '2024-01-01' as unknown as Date,
+      } as ContentDelivery);
+
+      const response = await app.inject({ method: 'GET', url });
+
+      expect(response.statusCode).toBe(500);
+      expect(protectiveHeaders(response)).toEqual(unprotected);
+    });
+  });
+
   it.each([
     ['json', { type: 'json', value: {}, contentType: 'application/json' }],
     ['unknown', { type: 'inline', contentType: 'audio/wav', contentLength: 1 }],
diff --git a/src/routes/metadata.test.ts b/src/routes/metadata.test.ts
index b7018c3..1c147c0 100644
--- a/src/routes/metadata.test.ts
+++ b/src/routes/metadata.test.ts
@@ -8,6 +8,7 @@ import { mockReset } from 'vitest-mock-extended';
 import type { ContentSource, MetadataDelivery, MetadataSource } from '../storage/backend.js';
 import { prisma } from '../test/helpers/fastify.js';
 import { getAndHead } from '../test/helpers/getAndHead.js';
+import { protectiveHeaders, sandboxed, unprotected } from '../test/helpers/protectiveHeaders.js';
 import { entityRow } from '../test/helpers/rows.js';
 import { buildStorageApp } from '../test/helpers/storageApp.js';
 import type { StandardErrorResponse } from '../utils/errors.js';
@@ -153,6 +154,40 @@ describe('Metadata Route', () => {
     });
   });
 
+  describe('protective headers', () => {
+    it.each<[string, () => MetadataDelivery]>([
+      ['json', () => ({ type: 'json', value: { name: 'a' } })],
+      ['stream', () => ({ type: 'stream', open: () => Readable.from([crate]), contentLength: crate.length })],
+    ])('sandboxes a %s delivery on GET and HEAD', async (_, delivery) => {
+      metadata.mockImplementation(delivery);
+
+      const { get, head } = await both();
+
+      for (const response of [get, head]) {
+        expect(response.statusCode).toBe(200);
+        expect(protectiveHeaders(response)).toEqual(sandboxed);
+      }
+    });
+
+    it('adds neither to a redirect delivery, a 404 or a 500', async () => {
+      metadata
+        .mockResolvedValueOnce({ type: 'redirect', url: 'https://storage.example.com/ro-crate-metadata.json' })
+        .mockResolvedValueOnce(null)
+        .mockRejectedValueOnce(new Error('Storage is unreachable'));
+
+      const responses = [
+        await app.inject({ method: 'GET', url }),
+        await app.inject({ method: 'GET', url }),
+        await app.inject({ method: 'GET', url }),
+      ];
+
+      expect(responses.map((response) => response.statusCode)).toEqual([302, 404, 500]);
+      for (const response of responses) {
+        expect(protectiveHeaders(response)).toEqual(unprotected);
+      }
+    });
+  });
+
   it('answers 404 when the half returns null', async () => {
     metadata.mockReturnValue(null);
 
diff --git a/src/storage/deliver.ts b/src/storage/deliver.ts
index 3073501..ba317d9 100644
--- a/src/storage/deliver.ts
+++ b/src/storage/deliver.ts
@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 import { open } from 'node:fs/promises';
 import type { Readable } from 'node:stream';
 import type { FastifyReply, FastifyRequest } from 'fastify';
-import { setFileHeaders } from '../utils/headers.js';
+import { setDeliveryHeaders } from '../utils/headers.js';
 import type { ContentDelivery, JsonDelivery } from './backend.js';
 
 type SendOptions = {
@@ -34,7 +34,7 @@ export const sendDelivery = async (
   if (delivery.type === 'json' && json) {
     const body = Buffer.from(JSON.stringify(delivery.value));
     const etag = `"${createHash('sha256').update(body).digest('base64url')}"`;
-    setFileHeaders(reply, { contentType: delivery.contentType, contentLength: body.length, etag });
+    setDeliveryHeaders(reply, { contentType: delivery.contentType, contentLength: body.length, etag });
 
     return reply.code(200).send(head ? undefined : body);
   }
@@ -52,7 +52,7 @@ export const sendDelivery = async (
   }
 
   try {
-    setFileHeaders(reply, delivery);
+    setDeliveryHeaders(reply, delivery);
   } catch (error) {
     body?.destroy();
     throw error;
diff --git a/src/test/helpers/protectiveHeaders.ts b/src/test/helpers/protectiveHeaders.ts
new file mode 100644
index 0000000..fa7f623
--- /dev/null
+++ b/src/test/helpers/protectiveHeaders.ts
@@ -0,0 +1,13 @@
+import type { LightMyRequestResponse } from 'fastify';
+
+/**
+ * The protective headers a response carries, for comparing with `sandboxed`, `mediaOnly` or `unprotected`
+ */
+export const protectiveHeaders = (response: LightMyRequestResponse) => ({
+  csp: response.headers['content-security-policy'],
+  nosniff: response.headers['x-content-type-options'],
+});
+
+export const sandboxed = { csp: "default-src 'none'; style-src 'unsafe-inline'; sandbox", nosniff: 'nosniff' };
+export const mediaOnly = { csp: undefined, nosniff: 'nosniff' };
+export const unprotected = { csp: undefined, nosniff: undefined };
diff --git a/src/test/helpers/storageApp.ts b/src/test/helpers/storageApp.ts
index d8e570a..014f7f7 100644
--- a/src/test/helpers/storageApp.ts
+++ b/src/test/helpers/storageApp.ts
@@ -1,5 +1,5 @@
 import { Writable } from 'node:stream';
-import Fastify from 'fastify';
+import Fastify, { type FastifyInstance } from 'fastify';
 import { vi } from 'vitest';
 import type { Options } from '../../app.js';
 import app, { AllPublicAccess, AllVisibleEntityFilter, AllVisibleSearchFilter } from '../../app.js';
@@ -9,8 +9,9 @@ import { prisma } from './fastify.js';
 
 /**
  * The plugin over the mocked Prisma client, with `storage` and a log of every error it writes
+ * `configure` runs on an encapsulated scope, before the plugin is registered in it
  */
-export const buildStorageApp = async (storage: Options['storage']) => {
+export const buildStorageApp = async (storage: Options['storage'], configure?: (instance: FastifyInstance) => void) => {
   type LogLine = { err?: { message: string } };
   const errors: LogLine[] = [];
   const stream = new Writable({
@@ -22,13 +23,16 @@ export const buildStorageApp = async (storage: Options['storage']) => {
   const access = vi.fn<AccessFunction>(AllPublicAccess);
 
   const instance = Fastify({ logger: { level: 'error', stream } });
-  await instance.register(app, {
-    prisma,
-    search: fakeSearchBackend().backend,
-    access,
-    entityVisibilityFilter: AllVisibleEntityFilter,
-    searchVisibilityFilter: AllVisibleSearchFilter,
-    storage,
+  await instance.register(async (scope) => {
+    configure?.(scope);
+    await scope.register(app, {
+      prisma,
+      search: fakeSearchBackend().backend,
+      access,
+      entityVisibilityFilter: AllVisibleEntityFilter,
+      searchVisibilityFilter: AllVisibleSearchFilter,
+      storage,
+    });
   });
   await instance.ready();
 
diff --git a/src/utils/headers.ts b/src/utils/headers.ts
index ca133a9..e15955f 100644
--- a/src/utils/headers.ts
+++ b/src/utils/headers.ts
@@ -1,16 +1,36 @@
 import type { FastifyReply } from 'fastify';
 
-export const setFileHeaders = (
+/** Sandboxes deposited bytes; see docs/adr/0005-library-sandboxes-delivered-bytes.md */
+const contentSecurityPolicy = "default-src 'none'; style-src 'unsafe-inline'; sandbox";
+
+const token = "[!#$%&'*+\\-.^_`|~0-9a-z]+";
+const quotedString = '"(?:[^"\\\\]|\\\\.)*"';
+const mediaType = new RegExp(
+  `^(?:audio|video)/${token}(?:[ \\t]*;[ \\t]*${token}=(?:${token}|${quotedString}))*[ \\t]*$`,
+  'i',
+);
+
+// Chrome won't play media opened directly under this CSP, and a media document can't run script.
+// RFC 9110 grammar, so no comma outside quotes: browsers split the header as a list, respecting
+// quotes, and take the last type, so `audio/mpeg, text/html` is HTML
+const isMedia = (contentType: string) => mediaType.test(contentType);
+
+export const setDeliveryHeaders = (
   reply: FastifyReply,
   metadata: { contentType: string; contentLength: number; etag?: string; lastModified?: Date },
 ) => {
   reply.header('Content-Type', metadata.contentType);
   reply.header('Content-Length', metadata.contentLength.toString());
-
   if (metadata.etag) {
     reply.header('ETag', metadata.etag);
   }
   if (metadata.lastModified) {
     reply.header('Last-Modified', metadata.lastModified.toUTCString());
   }
+
+  // Last, so a throw above can't leave them on the 500
+  reply.header('X-Content-Type-Options', 'nosniff');
+  if (!isMedia(metadata.contentType)) {
+    reply.header('Content-Security-Policy', contentSecurityPolicy);
+  }
 };
diff --git a/website/examples/configuration/storage-headers.ts b/website/examples/configuration/storage-headers.ts
new file mode 100644
index 0000000..49bb942
--- /dev/null
+++ b/website/examples/configuration/storage-headers.ts
@@ -0,0 +1,21 @@
+import arocapi, { type Options } from 'arocapi';
+import Fastify from 'fastify';
+
+// Your arocapi options
+declare const options: Options;
+
+const fastify = Fastify();
+
+// In its own scope with arocapi, so the hook sees only arocapi's routes
+await fastify.register(async (scope) => {
+  // Let deposited HTML run scripts, still in an opaque origin
+  scope.addHook('onSend', async (_request, reply, payload) => {
+    if (reply.hasHeader('content-security-policy')) {
+      reply.header('Content-Security-Policy', 'sandbox allow-scripts');
+    }
+
+    return payload;
+  });
+
+  await scope.register(arocapi, options);
+});
diff --git a/website/src/content/docs/configuration/storage.mdx b/website/src/content/docs/configuration/storage.mdx
index ce86787..5b7e518 100644
--- a/website/src/content/docs/configuration/storage.mdx
+++ b/website/src/content/docs/configuration/storage.mdx
@@ -8,6 +8,7 @@ sidebar:
 import { Code } from '@astrojs/starlight/components';
 import storageDirectory from '@examples/configuration/storage-directory.ts?raw';
 import storageEntityMeta from '@examples/configuration/storage-entity-meta.ts?raw';
+import storageHeaders from '@examples/configuration/storage-headers.ts?raw';
 import storageMixing from '@examples/configuration/storage-mixing.ts?raw';
 import storageOcfl from '@examples/configuration/storage-ocfl.ts?raw';
 import storageS3 from '@examples/configuration/storage-s3.ts?raw';
@@ -116,6 +117,8 @@ Without `locate`, Metadata is read from `Entity.meta.storageKey` and Content fro
   `?disposition` and `?filename` still apply. Presigning makes no request, so a missing object is only found when the
   client follows the URL. The URL bypasses access until it expires, so keep `expiresIn` short; a download only has to
   start within it. A browser on another origin needs CORS on the bucket, or `?noRedirect=true`.
+  arocapi can't add its [protective headers](#protective-headers) to the bucket's response; see [protecting the
+  target](/strategies/storage/#stream-path-or-redirect).
 - **`stream`** proxies the bytes through arocapi, so clients never reach the bucket. Metadata is always served this
   way. arocapi reads Content-Length, ETag and Last-Modified with `HeadObject`, then fetches that same version with
   `GetObject` and `If-Match`; an object replaced in between is a 500 rather than a mix of two versions.
@@ -173,6 +176,39 @@ object id and `path` a logical path in the object's head version.
 Content-Length and Last-Modified come from the file on disk, with a strong ETag from its inventory digest.
 Content-Type comes from `File.mediaType`; Metadata is always `application/ld+json`.
 
+## Protective headers
+
+Content and Metadata come from depositors, and arocapi serves them on its own origin. So that a deposited HTML or SVG
+file can't run scripts there, every `stream`, `path` and `json` delivery is sent, on `GET` and `HEAD`, with:
+
+| Header                    | Value                                                    | Sent on                         |
+| ------------------------- | -------------------------------------------------------- | ------------------------------- |
+| `X-Content-Type-Options`  | `nosniff`                                                | every delivery                  |
+| `Content-Security-Policy` | `default-src 'none'; style-src 'unsafe-inline'; sandbox` | all but `audio/*` and `video/*` |
+
+`sandbox` gives the page an opaque origin and blocks its scripts, and `default-src 'none'` stops it loading outside
+images, fonts or stylesheets, and `data:` images and fonts embedded in it too; inline styles still apply. PDFs, images and text still display inline, though Safari
+before 18.4 won't show a PDF under `sandbox`. `nosniff` stops a browser treating a file as a more dangerous type than
+its Content-Type.
+
+Audio and video get no CSP, because Chrome won't play media opened directly under it. A media document can't run
+script, and `nosniff` stops a file labelled as media being sniffed into HTML. The exemption needs a single `audio/*` or
+`video/*` type, in upper or lower case and with any parameters such as `; codecs=opus`, including quoted values with
+commas such as `; codecs="avc1.42E01E, mp4a.40.2"`. A list such as `audio/mpeg, text/html` keeps the CSP, as a browser
+reads the last type in it. `<audio>`, `<video>` and `<img>` elements on other pages ignore the CSP
+and keep working.
+
+Redirect deliveries, and the `noRedirect` answer, carry neither header, since they can't protect the target.
+
+The headers are fixed. A deployment that needs deposited HTML to run can replace or remove them in its own `onSend`
+hook. Add the hook and register arocapi together in one plugin, so the hook sees only arocapi's routes and leaves your
+own pages' headers, such as a CSP from `@fastify/helmet`, alone:
+
+<Code code={storageHeaders} lang="ts" />
+
+[ADR 0005](https://github.com/crate-works/arocapi/blob/main/docs/adr/0005-library-sandboxes-delivered-bytes.md)
+records why.
+
 ## Query parameters
 
 `/file/:id` accepts, on `GET` and `HEAD`:
diff --git a/website/src/content/docs/reference/storage-backend.mdx b/website/src/content/docs/reference/storage-backend.mdx
index 118493a..da14371 100644
--- a/website/src/content/docs/reference/storage-backend.mdx
+++ b/website/src/content/docs/reference/storage-backend.mdx
@@ -59,6 +59,9 @@ disagree.
 Metadata is always sent as `application/ld+json`, so its deliveries carry no `contentType`. A `content` half returning
 `json` is a type error.
 
+arocapi can't add its [protective headers](/configuration/storage/#protective-headers) to a `redirect` target, so the
+target has to protect itself; see [protecting the target](/strategies/storage/#stream-path-or-redirect).
+
 ## Errors
 
 - `null` is a 404 `NOT_FOUND`. Turn your storage's own "missing" errors into `null`.