Security: CSP allows 'unsafe-inline' for scripts and styles
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Start by comparing the CSP definitions in netlify.toml and static/_headers, then locate how the inline Typekit loader is served. Determine how a nonce or hash can be applied without weakening the existing policy, and verify that the resulting headers no longer require 'unsafe-inline' for scripts or styles. Consider the optional HSTS preload separately.
Written by the indexing model from the issue text.
Description
Problem
The CSP includes script-src 'self' 'unsafe-inline' use.typekit.net ... and style-src 'self' 'unsafe-inline' .... Not an SEO ranking factor, but 'unsafe-inline' weakens XSS protection. (The rest of the header set is excellent: HSTS, nosniff, X-Frame-Options DENY, Referrer-Policy, Permissions-Policy.)
Fix
Move to a nonce/hash-based CSP for the inline Typekit loader; optionally add preload to HSTS.
Files: netlify.toml / static/_headers
Found by /seo audit (technical), 2026-05-29.
- Dominant language
- HTML
- Stars
- 1
- Forks
- 0
- Avg merge
- 23h 24m
- Merged PRs (30d)
- 1
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PythonIreland/2026.pycon.ie
-
priority: low seo
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
content priority: medium
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
priority: low
Difficulty 1/5 Under an hour Newbie friendliness 86/100
-
enhancement priority: medium seo
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
bug priority: medium seo
Difficulty 1/5 Under an hour Newbie friendliness 88/100
All issues in PythonIreland/2026.pycon.ie
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
influxdata/helm-charts#856 ·
Maintainers usually reply within 5 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 69/100
postmanlabs/newman#3388 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
coollabsio/coolify#12094 · 1 comment ·
Maintainers usually reply within 1 day
-
[quality] e2e coverage failure reports say 'run null; status unknown' for every error raised after the manifest is readPossibly taken @hivecommons-hive claimed this today. Openagent/quality hive/covered-by-pr hive/hosted-available-lke648397-260827-5n31 quality testing
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
cncf/endusers#1069 · 1 comment ·
Maintainers usually reply within 1 day
-
agentic-workflows untriaged
Difficulty 1/5 Under an hour Newbie friendliness 65/100
Maintainers usually reply within 1 day