From efddf28ee0aeff727b17603474674b1d43144018 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Sun, 4 Oct 2026 19:35:05 +0000
Subject: [PATCH] chore: remove decommissioned feedback.profullstack.com widget

The Profullstack feedback widget (feedback.profullstack.com) has been
decommissioned. Drop its embed and its Content-Security-Policy host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 apps/web/src/app/layout.tsx | 5 +----
 apps/web/src/middleware.ts  | 4 ++--
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/apps/web/src/app/layout.tsx b/apps/web/src/app/layout.tsx
index 65c84c1b..a61f67a0 100644
--- a/apps/web/src/app/layout.tsx
+++ b/apps/web/src/app/layout.tsx
@@ -1,7 +1,6 @@
 import type { Metadata, Viewport } from 'next';
 import Script from 'next/script';
 import { headers } from 'next/headers';
-import { FeedbackWidget } from '@profullstack/stack/feedback';
 import { PWAInstallButton } from '@/components/pwa';
 import './globals.css';
 
@@ -121,7 +120,7 @@ export default async function RootLayout({ children }: { children: React.ReactNo
   const requestHeaders = await headers();
   const nonce = requestHeaders.get('x-nonce') ?? undefined;
   // /embed/* renders inside a third party's page (flag set in middleware). Site
-  // chrome — org schema, install prompt, analytics, feedback widget — would be
+  // chrome — org schema, install prompt, analytics — would be
   // wrong there, so the embed gets the bare player and nothing else.
   const isEmbed = requestHeaders.get('x-embed') === '1';
 
@@ -158,8 +157,6 @@ export default async function RootLayout({ children }: { children: React.ReactNo
           src="https://crawlproof.com/stats.js"
           strategy="afterInteractive"
         />
-        {/* exactOptionalPropertyTypes: pass nonce only when middleware set one */}
-        <FeedbackWidget property="pairux.com" {...(nonce ? { nonce } : {})} />
       </body>
     </html>
   );
diff --git a/apps/web/src/middleware.ts b/apps/web/src/middleware.ts
index 421434cd..3838550c 100644
--- a/apps/web/src/middleware.ts
+++ b/apps/web/src/middleware.ts
@@ -27,7 +27,7 @@ function mediaOrigin(): string {
 function buildCsp(nonce: string, embeddable: boolean): string {
   return [
     "default-src 'self'",
-    `script-src 'self' 'nonce-${nonce}' 'wasm-unsafe-eval' https://crawlproof.com https://datafa.st https://feedback.profullstack.com`,
+    `script-src 'self' 'nonce-${nonce}' 'wasm-unsafe-eval' https://crawlproof.com https://datafa.st`,
     "style-src 'self' 'unsafe-inline'",
     "img-src 'self' data: blob: https:",
     `media-src 'self' blob: ${mediaOrigin()}`,
@@ -59,7 +59,7 @@ export async function middleware(request: NextRequest) {
   const requestHeaders = new Headers(request.headers);
   requestHeaders.set('x-nonce', nonce);
   requestHeaders.set('content-security-policy', csp);
-  // Lets the root layout drop chrome (analytics, feedback widget, PWA prompt)
+  // Lets the root layout drop chrome (analytics, PWA prompt)
   // that has no business rendering inside someone else's page.
   if (isEmbed) requestHeaders.set('x-embed', '1');