Security hardening: CSP, Referrer Policy, Bunny Fonts, iframe sandbox

[Copilot]

Security audit of remotehack.space — several attack vectors identified and mitigated.

Attack vectors & fixes

Content Security Policy (high)

No CSP existed, leaving the site open to XSS and resource injection. Added a strict CSP <meta> tag:

default-src 'self';
script-src 'self';
style-src 'self' https://fonts.bunny.net;
font-src https://fonts.bunny.net;
img-src 'self' data:;
frame-src https://open.spotify.com;
connect-src 'self';
object-src 'none';
base-uri 'self';
form-action 'self'

Inline scripts blocked a strict CSP (medium)

Two inline <script> blocks (nav active-link highlight, local-time formatting) would have required unsafe-inline, defeating script-src protection.

• Nav script → assets/nav-current.js
• Local-time script → assets/local-time.js
• Template <script> blocks in hack.html and index.html replaced with <span class="local-time"> driven by the new external script

Google Fonts → Bunny Fonts (medium / GDPR)

Every page load was sending user IPs to Google. Swapped fonts.googleapis.com / fonts.gstatic.com for Bunny Fonts — drop-in compatible, GDPR-compliant, no IP logging.

Referrer Policy (low-medium)

Full page URLs were leaking to external sites via Referer header on every outbound click.

<meta name="referrer" content="strict-origin-when-cross-origin">

Spotify iframe sandbox (low)

Embedded iframe had unrestricted browser API access. Added:

sandbox="allow-scripts allow-same-origin allow-presentation"

Player functionality is preserved; top-navigation and popup access are removed.

External link rel (low)

Added rel="noopener noreferrer" to external footer links.

---

Note: X-Frame-Options, X-Content-Type-Options, and frame-ancestors CSP require HTTP response headers and cannot be set via <meta> on GitHub Pages — clickjacking protection at that level would need a proxy (e.g. Cloudflare) in front.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• fonts.googleapis.com
  • Triggering command: /usr/bin/curl curl -s REDACTED;600&family=Space+Mono:wght@400&display=swap (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

would you be able to run a security audit on remotehack.space?

try and compile any attack vectors that we have open.

and then apply fixes for any that you find!

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[benfoxall]

Context: I'm at a talk about strix, and was wondering how copilot compares

[lpmi-13]

@copilot please confirm whether merging this would break the current site or disrupt any current functionality. Please base this analysis on the current HEAD ref of the main branch.

[Copilot]

@copilot please confirm whether merging this would break the current site or disrupt any current functionality. Please base this analysis on the current HEAD ref of the main branch.

Analysis based on the current main HEAD and the PR diff:

Core functionality is preserved — navigation, layout, fonts, the local-time display, and the previous-hacks summariser all continue to work. Here are the three areas where the strict CSP introduces visible side-effects:

---

1. Twitter embed on /hacks/11/ — external script blocked ⚠️

_hacks/11.md loads <script async src="https://platform.twitter.com/widgets.js">. The CSP directive script-src 'self' will block that third-party script, so the embedded tweets on that archive page will remain as unstyled plain <blockquote> HTML rather than rendered Twitter cards. The page loads and all other content is readable; the embeds just won't get their Twitter styling.

2. Bold time display on hack pages — inline style silently stripped ⚠️

_layouts/hack.html still contains <time style="font-weight: bold;" …>. The CSP style-src 'self' https://fonts.bunny.net (no 'unsafe-inline') will cause browsers to silently ignore that inline style attribute, so the date/time on upcoming-hack pages will no longer render in bold. The text still displays; only the font-weight is lost.

3. Spotify "Open in Spotify" popup — blocked by sandbox (minor) ⚠️

The added sandbox="allow-scripts allow-same-origin allow-presentation" does not include allow-popups, so clicking "Open in Spotify" inside the embedded Spotify player won't open a new tab/window. Audio playback within the iframe continues to work normally.

---

Everything else is unaffected:

• Google Fonts → Bunny Fonts: drop-in compatible, same families (Inter, Space Mono)
• nav-current.js / local-time.js with defer: functionally identical to the original inline scripts
• <script type="application/ld+json"> in index.html: not restricted by script-src (it's a data block, not executable JS)
• The prompt-api-summaries.js fetch('/feed.xml') call: same-origin, allowed by connect-src 'self'
• Referrer Policy: no behavioural change (modern browsers already default to strict-origin-when-cross-origin)

[lpmi-13]

Superseded by #270