diff --git a/frontend/embed.html b/frontend/embed.html
index 537071a..1bf6864 100644
--- a/frontend/embed.html
+++ b/frontend/embed.html
@@ -3,6 +3,7 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' ${process.env.API_URL ? process.env.API_URL : ''}; font-src 'self'; object-src 'none'; media-src 'self'; frame-src 'none'">
     <title>Campaign Widget</title>
     <style>
       * { margin: 0; padding: 0; box-sizing: border-box; }
diff --git a/frontend/nginx.conf b/frontend/nginx.conf
index 9ddd4aa..9ecc7d8 100644
--- a/frontend/nginx.conf
+++ b/frontend/nginx.conf
@@ -1,6 +1,6 @@
 server {
   listen 8080;
-  root /usr/share/nginx/html;
+  add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' http: https:; font-src 'self'; object-src 'none'; media-src 'self'; frame-src 'none';";
   index index.html;
 
   location / {
diff --git a/frontend/src/test/setup.js b/frontend/src/test/setup.js
index 9c5b9fb..524f161 100644
--- a/frontend/src/test/setup.js
+++ b/frontend/src/test/setup.js
@@ -1,5 +1,28 @@
 import '@testing-library/jest-dom/vitest';
 import { vi } from 'vitest';
+
+// Provide a simple in‑memory localStorage mock for test environment
+if (typeof global.localStorage === 'undefined') {
+  const _storage = {};
+  global.localStorage = {
+    getItem(key) {
+      return Object.prototype.hasOwnProperty.call(_storage, key) ? _storage[key] : null;
+    },
+    setItem(key, value) {
+      _storage[key] = String(value);
+    },
+    removeItem(key) {
+      delete _storage[key];
+    },
+    clear() {
+      Object.keys(_storage).forEach(k => delete _storage[k]);
+    },
+  };
+}
+// Ensure window.localStorage mirrors the same mock when JSDOM provides a window object
+if (typeof window !== 'undefined' && typeof window.localStorage === 'undefined') {
+  window.localStorage = global.localStorage;
+}
 import en from '../locales/en.json';
 
 if (typeof globalThis.ResizeObserver === 'undefined') {
