🛡️ Sentinel: [보안 개선] 메인 페이지 CSP 강화 및 검증 테스트 추가

[seonghobae]

🚨 Severity: HIGH
💡 Vulnerability: 메인 index.html이 느슨한 default-src 'self' CSP와 base-uri 'self'를 사용하고 있어, 엄격한 거부 기본(deny-by-default) 접근 방식보다 취약했습니다. 외부 스크립트나 동적 콘텐츠가 추후 추가될 경우 공격 표면이 넓은 상태였습니다.
🎯 Impact: 향후 안전하지 않은 DOM 싱크가 도입되거나 서드파티 스크립트가 훼손될 경우, XSS나 데이터 주입 공격에 노출될 수 있습니다.
🔧 Fix: index.html의 CSP를 default-src 'none'으로 변경하고, 필요한 자산만 명시적으로 허용(script-src 'self', style-src 'self' 등)하도록 강화했습니다. 또한 base-uri와 object-src를 'none'으로 설정했습니다.
✅ Verification: 이 변경 사항을 유지하고 검증하기 위해 tests/test_index_security.py 회귀 테스트를 추가했습니다. 테스트 스위트가 모두 정상 통과합니다.

---

PR created automatically by Jules for task 10918979539190325931 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

This PR hardens the static site’s main entrypoint (index.html) by switching to a strict deny-by-default Content Security Policy (CSP) and adding Python regression tests to prevent future CSP loosening or inline active-content regressions.

Changes:

• Strengthen index.html CSP to default-src 'none' with explicit allowlists for required asset types and stronger restrictions (base-uri 'none', frame-src 'none', Trusted Types enforcement).
• Add tests/test_index_security.py to assert the strict CSP is present and that no inline <style>, inline <script>, style=, or on*= handlers exist.
• Document the security change in CHANGELOG.md and record the security learning in .jules/sentinel.md.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
index.html	Replaces permissive CSP with a strict allowlist CSP suitable for a static GitHub Pages site.
tests/test_index_security.py	Adds regression tests that enforce strict CSP presence and absence of inline active content.
CHANGELOG.md	Notes the CSP hardening under [Unreleased] for user-facing security changes.
.jules/sentinel.md	Captures the CSP hardening lesson to prevent future regressions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.