From 3694f2b5c68eeb70413da1a377459bb7636083a0 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 31 Aug 2026 17:31:41 +0000
Subject: [PATCH] fix(web): deprecate app.supermemory.ai / and /login, add
 clickjacking headers

Redirect the old app entry points (/ , /login, /login/*) to the console
and send CSP frame-ancestors 'none' + X-Frame-Options: DENY on every
response so any remaining HTML surface cannot be framed, matching console.

Co-authored-by: Dhravya Shah <dhravya@supermemory.com>
---
 apps/web/next.config.ts | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/apps/web/next.config.ts b/apps/web/next.config.ts
index c4992e71..78da3425 100644
--- a/apps/web/next.config.ts
+++ b/apps/web/next.config.ts
@@ -37,8 +37,41 @@ const nextConfig: NextConfig = {
 		]
 	},
 	skipTrailingSlashRedirect: true,
+	async headers() {
+		// app.supermemory.ai is being deprecated in favour of the console.
+		// Anything that still serves HTML must not be framable, matching the
+		// console's clickjacking protection.
+		return [
+			{
+				source: "/:path*",
+				headers: [
+					{ key: "X-Frame-Options", value: "DENY" },
+					{
+						key: "Content-Security-Policy",
+						value: "frame-ancestors 'none'",
+					},
+				],
+			},
+		]
+	},
 	async redirects() {
 		return [
+			// The old app surface is dying: send its entry points to the console.
+			{
+				source: "/",
+				destination: "https://console.supermemory.ai",
+				permanent: false,
+			},
+			{
+				source: "/login",
+				destination: "https://console.supermemory.ai",
+				permanent: false,
+			},
+			{
+				source: "/login/:path*",
+				destination: "https://console.supermemory.ai",
+				permanent: false,
+			},
 			{
 				source: "/new",
 				destination: "/",