- Middleware sets CSP (default-src 'none'; style-src 'self'), HSTS,
X-Content-Type-Options, X-Frame-Options, Referrer-Policy,
Permissions-Policy on every response
- Inline <style> moved to /styles.css so CSP needs no unsafe-inline
- /favicon.ico returns a 1x1 GIF (kills 404 noise)
- Escape LLM jokes, article title, and URL before HTML rendering (XSS fix)
- FastAPI + APScheduler + SQLite, single container
- Daily generation at 06:00 Europe/Copenhagen + cold-start generation
- Retry with backoff (3 attempts/15 min), stale fallback with banner
- OpenAI-compatible endpoint via env (OPENAI_BASE_URL/MODEL/API_KEY)
- docker-compose with named volume for joke persistence
hermes