docs: update changelogs and README for frontend crate improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Web3NL

packages-rs/canister-dapp-test/CHANGELOG.md

@@ -4,6 +4,8 @@
 
 ### Added
 
+- Security header validation: all 8 security/privacy headers verified on frontend fallback responses
+- Gzip compression test: verifies Accept-Encoding negotiation returns compressed responses with correct headers
 - CLI binary: `canister-dapp-test <wasm-path>` runs the full acceptance suite against any dapp WASM.
 - HTTP response header validation: Content-Type for HTML/JS/CSS, Content-Security-Policy for dashboard HTML.
 - SPA fallback test: unknown paths serve index.html with 200 (client-side routing).

packages-rs/my-canister-frontend/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## [Unreleased]
 
+### Added
+
+- 8 default security/privacy HTTP headers on all asset responses: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection, Strict-Transport-Security, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy
+- Asset validation: file type allowlist, 2 MB size limit, duplicate path detection, path traversal and malformed URL rejection
+- Gzip compression for text-based assets (HTML, JS, CSS, JSON, SVG, XML, TXT, source maps)
+- `FrontendConfig` struct for customization (extra allowed extensions, custom size limit)
+- `setup_frontend_with_config()` for configurable frontend initialization
+- `asset_router_configs_with_config()` for configurable asset processing
+
+### Changed
+
+- `asset_router_configs()` now returns `Result` to surface validation errors (breaking)
+- Compressible assets are served with both Identity and Gzip encodings
+
+### Dependencies
+
+- Added `flate2` for gzip compression
+
 ## [0.2.1] - 2025-09-11
 
 ### Changed

packages-rs/my-canister-frontend/README.md

@@ -37,9 +37,34 @@ fn http_request(req: HttpRequest) -> HttpResponse {
 - Automatic MIME type detection using `mime_guess`
 - `index.html` auto-configured as fallback for `/`
 - Certification using [`ic-asset-certification`](https://docs.rs/ic-asset-certification)
+- **Security headers**: 8 default security/privacy headers on all responses (HSTS, X-Frame-Options, Referrer-Policy, etc.)
+- **Asset validation**: File type allowlist, 2 MB size limit, path traversal protection, duplicate detection
+- **Gzip compression**: Automatic gzip for text-based assets (HTML, JS, CSS, JSON, SVG)
+- **Configurable**: Use `FrontendConfig` to allow additional file types or adjust size limits
 - Exposes `with_asset_router` and `with_asset_router_mut` for access to the asset router, see example below.
 - Exposes `asset_router_configs` if you want to implement your own asset router, see [this example](https://github.com/Web3NL/my-canister-dapp/blob/e8fdc0ac81f7bdc702418c05130ace3f9f5399fb/examples/my-hello-world/src/backend/src/lib.rs).
 
+## Configuration
+
+To allow additional file types or customize settings:
+
+```rust,ignore
+use ic_cdk::init;
+use include_dir::{include_dir, Dir};
+use my_canister_frontend::{setup_frontend_with_config, FrontendConfig};
+
+static ASSETS: Dir = include_dir!("$CARGO_MANIFEST_DIR/../dapp-frontend/dist");
+
+#[init]
+fn init() {
+    let config = FrontendConfig {
+        extra_allowed_extensions: vec!["webmanifest".to_string()],
+        ..Default::default()
+    };
+    setup_frontend_with_config(&ASSETS, &config).expect("Failed to setup frontend");
+}
+```
+
 ## Usage with [`my_canister_dashboard`](https://crates.io/crates/my-canister-dashboard)
 
 ```rust,ignore