web.config

<configuration>
  <system.webServer>
    <security>
      <requestFiltering removeServerHeader="true" />
    </security>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />

        <!--
          See:
            - https://scotthelme.co.uk/a-new-security-header-referrer-policy/
            - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
        -->
        <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />

        <!--
          See:
            - https://scotthelme.co.uk/a-new-security-header-feature-policy/
            - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
        -->
        <add name="Feature-Policy" value="geolocation 'none'; midi 'none'; payment 'none'; camera 'none'; usb 'none'; fullscreen 'none'; magnetometer 'none'; picture-in-picture 'none'; accelerometer 'none'; autoplay 'none'; document-domain 'none'; encrypted-media 'none'; gyroscope 'none'; xr-spatial-tracking 'none'; sync-xhr 'none'; microphone 'none';" />

        <!--
          See:
            - https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
            - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

          style-src:
            - unsafe-inline: Dynamic HTML created when clicking the "Copy signature" button

          img-src:
            - https://readifysignatures.blob.core.windows.net: Purple logo in the signature

          connect-src:
            - https://login.microsoftonline.com: AAD login

          frame-ancestors:
            - https://teamtelstra.sharepoint.com: The app is embedded in a SharePoint page
        -->
        <add name="Content-Security-Policy" value="script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' https://readifysignatures.blob.core.windows.net; connect-src https://login.microsoftonline.com; frame-ancestors https://teamtelstra.sharepoint.com; report-uri https://telstrapurple.report-uri.com/r/d/csp/enforce" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>