security: remove landing-only third-party CSP permissions

Author: emir-karabeg

apps/sim/components/logo-shell/logo-shell.tsx

@@ -6,7 +6,7 @@ import { DesktopTitleBarLane } from '@/app/_shell/desktop-title-bar'
 /**
  * Logo-only page frame shared by status pages and public interfaces. Interfaces
  * default to light tokens; status pages inherit the active theme. The home link
- * uses document navigation so marketing initializes its own theme store.
+ * uses document navigation across the independently served website boundary.
  *
  * Children decide their own layout: pass `center` for a single centered column
  * (404 message, simple gates); omit it for full-width content (the live chat

apps/sim/components/status-page/return-home-link.tsx

@@ -2,7 +2,7 @@
 
 import { ChipLink } from '@sim/emcn'
 
-/** A document navigation initializes the landing theme when leaving an app status page. */
+/** Leave the app router when navigating to the independently served homepage. */
 export function ReturnHomeLink() {
   return (
     <ChipLink

apps/sim/lib/api/contracts/index.ts

@@ -1,6 +1,6 @@
 /**
  * Deliberately NOT re-exported from this barrel: `./tools` (per-integration tool
- * contracts), `./selectors`, `./v1` (admin API), and `./demo-requests`. All of their
+ * contracts), `./selectors`, and `./v1` (admin API). All of their
  * consumers import those files directly, and re-exporting them here shipped their Zod
  * schema construction (~60 KB gzip) to every route that touches any contract — schema
  * objects are built at module scope, so `export *` defeats tree-shaking for them.

apps/sim/lib/core/security/csp.ts

@@ -99,8 +99,6 @@ const STATIC_SCRIPT_SRC = [
   'https://*.google.com',
   'https://apis.google.com',
   'https://challenges.cloudflare.com',
-  // Cal.com booking embed (landing /demo) — embed.js is served from app.cal.com
-  'https://app.cal.com',
   ...(isReactGrabEnabled ? ['https://unpkg.com'] : []),
   ...(isHosted
     ? [
@@ -111,9 +109,6 @@ const STATIC_SCRIPT_SRC = [
         'https://www.googleadservices.com',
         'https://googleads.g.doubleclick.net',
         'https://analytics.ahrefs.com',
-        // X (Twitter) conversion pixel (landing pages) — the base code injects
-        // uwt.js as a <script> tag from static.ads-twitter.com
-        'https://static.ads-twitter.com',
         // Freebuff Ads conversion tag — freebuff-tag.js
         'https://freebuff.com',
       ]
@@ -139,9 +134,6 @@ const STATIC_CONNECT_SRC = [
   'https://github.com/*',
   'https://status.sim.ai',
   'https://challenges.cloudflare.com',
-  // Cal.com booking embed (landing /demo) — embed XHR/availability calls
-  'https://app.cal.com',
-  'https://cal.com',
   ...(isReactGrabEnabled ? ['https://www.react-grab.com'] : []),
   ...(isDev ? ['ws://localhost:4722'] : []),
   ...(isHosted
@@ -158,10 +150,6 @@ const STATIC_CONNECT_SRC = [
         'https://*.g.doubleclick.net',
         // Google Ads conversion tag — conversion beacons
         'https://www.googleadservices.com',
-        // X (Twitter) conversion pixel — uwt.js sends conversion beacons here
-        // via fetch/sendBeacon. The t.co image-pixel fallback is already
-        // covered by the `https:` wildcard in img-src.
-        'https://analytics.twitter.com',
         // Freebuff Ads conversion tag — beacons to /api/advertisers/conversions/client
         'https://freebuff.com',
       ]
@@ -172,9 +160,6 @@ const STATIC_FRAME_SRC = [
   "'self'",
   'blob:',
   'https://challenges.cloudflare.com',
-  // Cal.com booking embed (landing /demo) — the booking iframe
-  'https://app.cal.com',
-  'https://cal.com',
   'https://drive.google.com',
   'https://docs.google.com',
   'https://*.google.com',