diff --git a/_layouts/default.html b/_layouts/default.html
index d1e9fb2..7f5ed97 100644
--- a/_layouts/default.html
+++ b/_layouts/default.html
@@ -4,8 +4,10 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+  <meta name="referrer" content="strict-origin-when-cross-origin">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://platform.twitter.com; style-src 'self' https://fonts.bunny.net; font-src https://fonts.bunny.net; img-src 'self' data: https://pbs.twimg.com https://abs.twimg.com; frame-src https://open.spotify.com https://platform.twitter.com; connect-src 'self' https://syndication.twitter.com; object-src 'none'; base-uri 'self'; form-action 'self'">
 
-  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600&family=Space+Mono:wght@400&display=swap"
+  <link href="https://fonts.bunny.net/css2?family=Inter:wght@400;600&family=Space+Mono:wght@400&display=swap"
     rel="stylesheet">
   <link rel="stylesheet" href="/assets/style.css">
 
@@ -63,9 +65,8 @@
     {% endunless %}
   </nav>
 
-  <script>
-    for (const a of document.querySelectorAll('.🗺 a')) if (location.href === a.href) a.classList.add('current')
-  </script>
+  <script src="/assets/nav-current.js" defer></script>
+  <script src="/assets/local-time.js" defer></script>
 
 
   {% if page.show_header %}
@@ -90,10 +91,10 @@ <h1 class="⭐️">
     <footer>
       <ul class="🔗">
         <li>
-          Header image – <a href="https://back7.co/home/raspberry-pi-recovery-kit">The Raspberry Pi Recovery Kit</a>
+          Header image – <a href="https://back7.co/home/raspberry-pi-recovery-kit" rel="noopener noreferrer">The Raspberry Pi Recovery Kit</a>
         </li>
         <li>
-          Site hosted with <a href="https://github.com">Github</a>. {% if site.github %}View the <a href="{{ site.github.repository_url }}">source repository</a>.{% endif %}
+          Site hosted with <a href="https://github.com" rel="noopener noreferrer">Github</a>. {% if site.github %}View the <a href="{{ site.github.repository_url }}" rel="noopener noreferrer">source repository</a>.{% endif %}
         </li>
       </ul>
     </footer>
diff --git a/_layouts/hack.html b/_layouts/hack.html
index ccc30e1..356bc0c 100644
--- a/_layouts/hack.html
+++ b/_layouts/hack.html
@@ -11,19 +11,7 @@ <h1>
 {% if pagesize < 2 %}
   {%- capture content -%}
   {% assign start_time = page.date | slice:0,10 | append:"T08:30Z" %}
-  This hack is happening on <time style="font-weight: bold;" datetime="{{start_time}}">{{ start_time| date_to_long_string }}<span>
-    <script>
-      document.currentScript.replaceWith(
-        document.createTextNode(
-          new Intl.DateTimeFormat('default', {
-            hour: 'numeric',
-            minute: 'numeric',
-            timeZoneName: 'long'
-          })
-            .format(new Date("{{start_time}}"))
-        )
-      )
-    </script>
+  This hack is happening on <time class="hack-time" datetime="{{start_time}}">{{ start_time| date_to_long_string }}<span class="local-time">
     <noscript>
       {{ start_time | date: "%k:%M%P %Z" }}
     </noscript>
diff --git a/_sass/_style.scss b/_sass/_style.scss
index f5a72a5..b683c0b 100644
--- a/_sass/_style.scss
+++ b/_sass/_style.scss
@@ -154,6 +154,9 @@ ol {
 		}
 	}
 }
+.hack-time {
+	font-weight: bold;
+}
 .🗺 {
 	max-width: 42em;
 	margin: 3em auto;
diff --git a/assets/local-time.js b/assets/local-time.js
new file mode 100644
index 0000000..5f69dc3
--- /dev/null
+++ b/assets/local-time.js
@@ -0,0 +1,13 @@
+document.querySelectorAll('time[datetime] .local-time').forEach(function (span) {
+  var timeEl = span.closest('time[datetime]');
+  if (!timeEl) return;
+  var dt = timeEl.getAttribute('datetime');
+  if (!dt) return;
+  try {
+    span.textContent = new Intl.DateTimeFormat('default', {
+      hour: 'numeric',
+      minute: 'numeric',
+      timeZoneName: 'long'
+    }).format(new Date(dt));
+  } catch (e) {}
+});
diff --git a/assets/nav-current.js b/assets/nav-current.js
new file mode 100644
index 0000000..1c8ba27
--- /dev/null
+++ b/assets/nav-current.js
@@ -0,0 +1,3 @@
+for (const a of document.querySelectorAll('.🗺 a')) {
+  if (location.href === a.href) a.classList.add('current');
+}
diff --git a/pages/index.html b/pages/index.html
index 4e649cd..7f1f1ce 100644
--- a/pages/index.html
+++ b/pages/index.html
@@ -19,19 +19,7 @@ <h2>Next event</h2>
         <time class="⏰" datetime="{{start_time}}">
           {{ start_time | date_to_long_string }}
 
-          <span>
-            <script>
-              document.currentScript.replaceWith(
-                document.createTextNode(
-                  new Intl.DateTimeFormat('default', {
-                    hour: 'numeric',
-                    minute: 'numeric',
-                    timeZoneName: 'long'
-                  })
-                    .format(new Date("{{start_time}}"))
-                )
-              )
-            </script>
+          <span class="local-time">
             <noscript>
               {{ start_time | date: "%k:%M%P %Z" }}
             </noscript>
diff --git a/pages/podcast.md b/pages/podcast.md
index 9ecd824..f26f45a 100644
--- a/pages/podcast.md
+++ b/pages/podcast.md
@@ -27,4 +27,4 @@ _Or_, subscribe on Spotify:
 
 You can hear the latest published episode here: 
 
-<iframe src="https://open.spotify.com/embed-podcast/show/2ppoyoTxxSv9IvRGGqLWP7" width="100%" height="232" frameborder="0" allowtransparency="true" allow="encrypted-media" title="Spotify Podcast player - Airquotes the Podcast Airquotes"></iframe>
\ No newline at end of file
+<iframe src="https://open.spotify.com/embed-podcast/show/2ppoyoTxxSv9IvRGGqLWP7" width="100%" height="232" frameborder="0" allowtransparency="true" allow="encrypted-media" title="Spotify Podcast player - Airquotes the Podcast Airquotes" sandbox="allow-scripts allow-same-origin allow-presentation allow-popups"></iframe>
\ No newline at end of file
