SA-2026-018: No Content-Security-Policy on a site that holds secrets in the browser

What it is

No page had a CSP, while the origin holds readers' vault keys and signing keys and renders third-party text. Every escaping bug was a full compromise.

What an attacker could do

Any XSS (SA-2026-012 was one) ran with access to everything the origin holds.

How: Any injected markup with a handler or script.

Root cause

Defence in depth was not part of the design, because the site started as static pages with no secrets.

What contributed

• GitHub Pages cannot send headers, so a policy has to ride in a meta tag; nobody had done that work.

What was not in place

A second wall behind escaping.

The fix

Every page carries a CSP meta tag: scripts only from the site and hashed inline scripts; connections only to the services the pages use; no objects, no base, forms to self.

What prevents it now

Crawled all 802 pages with zero violations; injected handlers, javascript: URLs and scripts are refused. frame-ancestors needs a header (SA-2026-039).