fix: add security headers (CSP, X-Frame-Options) and harden env handling

- Add CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy headers
- Change supabase.ts to throw on missing env vars instead of using fallback values
- Add .env.production to .gitignore

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: GudE-R

.gitignore

@@ -11,6 +11,7 @@ yarn-error.log*
 pnpm-debug.log*
 .vercel
 .env*.local
+.env.production
 
 # Test coverage
 coverage/

apps/web/next.config.ts

@@ -6,6 +6,31 @@ const withNextIntl = createNextIntlPlugin();
 
 const nextConfig: NextConfig = {
   transpilePackages: ['@studytodo/shared'],
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: [
+          {
+            key: 'Content-Security-Policy',
+            value: [
+              "default-src 'self'",
+              "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://pagead2.googlesyndication.com https://www.googletagmanager.com",
+              "style-src 'self' 'unsafe-inline'",
+              "img-src 'self' data: https:",
+              "font-src 'self'",
+              "connect-src 'self' https://*.supabase.co wss://*.supabase.co",
+              "frame-src https://pagead2.googlesyndication.com",
+              "frame-ancestors 'none'",
+            ].join('; '),
+          },
+          { key: 'X-Frame-Options', value: 'DENY' },
+          { key: 'X-Content-Type-Options', value: 'nosniff' },
+          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+        ],
+      },
+    ];
+  },
 };
 
 export default withNextIntl(nextConfig);

apps/web/src/lib/supabase.ts

@@ -3,18 +3,12 @@ import { createClient } from '@supabase/supabase-js';
 const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
 const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
 
-// 環境変数がロードされていない場合のエラーハンドリング
 if (!supabaseUrl || !supabaseAnonKey) {
-    console.error(`
-        [Supabase Error] Environment variables missing.
-        NEXT_PUBLIC_SUPABASE_URL: ${supabaseUrl ? "Loaded" : "Missing"}
-        NEXT_PUBLIC_SUPABASE_ANON_KEY: ${supabaseAnonKey ? "Loaded" : "Missing"}
-        Please check .env.local content format.
-    `);
+    throw new Error(
+        `Supabase environment variables missing. ` +
+        `NEXT_PUBLIC_SUPABASE_URL: ${supabaseUrl ? "OK" : "Missing"}, ` +
+        `NEXT_PUBLIC_SUPABASE_ANON_KEY: ${supabaseAnonKey ? "OK" : "Missing"}`
+    );
 }
 
-// クライアント作成（URLがない場合は空文字を渡すが、これを使用するとエラーになるため、使用側でチェックが必要）
-export const supabase = createClient(
-    supabaseUrl || "https://placeholder.supabase.co",
-    supabaseAnonKey || "placeholder-key"
-);
+export const supabase = createClient(supabaseUrl, supabaseAnonKey);