diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 4f173bc..16b6673 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -38,3 +38,8 @@
**Vulnerability:** Missing input validation on `setLanguage()` could allow invalid strings (like Prototype Pollution payloads or arbitrary text) to be applied to the DOM (`lang` attribute) and stored in `localStorage`.
**Learning:** The global `setLanguage` function assumed inputs would only come from predefined button clicks, skipping runtime validation.
**Prevention:** Always sanitize and validate function arguments at the application boundary, even if the primary caller is trusted, to enforce defense in depth.
+
+## 2025-02-12 - [Strict CSP on Main Page]
+**Vulnerability:** The main `index.html` used a permissive `default-src 'self'` CSP and `base-uri 'self'`, which is weaker than a strict deny-by-default approach.
+**Learning:** Even static HTML sites should use a strict deny-by-default CSP (`default-src 'none'`) and explicitly allow only necessary asset types (`script-src`, `style-src`, etc.) to minimize attack surface in case of future changes or vulnerabilities. `base-uri 'none'` and `object-src 'none'` are also crucial.
+**Prevention:** Always default to a strict `default-src 'none'` CSP for all HTML entry points, explicitly declaring necessary sources.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 56ad628..74f5eb9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,3 +12,4 @@
- **보안 개선**: `i18n.js`의 `setLanguage()` 함수에 허용된 언어인지 확인하는 입력값 검증(Input Validation) 로직을 추가하여 Prototype Pollution 및 유효하지 않은 상태 주입을 방지했습니다.
- **성능 개선**: `i18n.js`에서 초기 로드 시 기본 언어가 한국어(ko)인 경우 불필요한 DOM 순회 및 텍스트 업데이트를 생략하도록 개선했습니다.
- **테스트 추가**: 다국어 처리 로직의 무결성을 검증하기 위해 `test_i18n.html` 테스트 파일을 추가했습니다.
+- **보안 개선**: 메인 페이지(`index.html`)의 Content-Security-Policy를 `default-src 'none'` 기반의 엄격한 화이트리스트 방식으로 강화하여 잠재적인 공격 표면을 최소화했습니다.
diff --git a/index.html b/index.html
index c40fea3..fd888db 100644
--- a/index.html
+++ b/index.html
@@ -3,7 +3,7 @@
-
+
맥락지혜 연구실 | Contextual Wisdom Lab
str:
+ """Return the main index.html source."""
+ return INDEX.read_text(encoding="utf-8")
+
+
+def _csp_content(html: str) -> str:
+ """Extract the CSP meta policy from the HTML."""
+ match = re.search(
+ r' None:
+ """The main page limits active content using a strict deny-by-default CSP."""
+ policy = _csp_content(_index_html())
+
+ for directive in (
+ "default-src 'none'",
+ "script-src 'self'",
+ "img-src 'self'",
+ "font-src 'self'",
+ "connect-src 'self'",
+ "object-src 'none'",
+ "base-uri 'none'",
+ "form-action 'none'",
+ "frame-src 'none'",
+ "upgrade-insecure-requests",
+ "require-trusted-types-for 'script'",
+ "style-src 'self'",
+ ):
+ assert directive in policy
+ assert "'unsafe-inline'" not in policy
+ assert "'unsafe-eval'" not in policy
+
+def test_index_has_no_inline_active_content() -> None:
+ """Strict CSP remains enforceable without inline script or style exceptions."""
+ html = _index_html()
+
+ assert re.search(r")", html, flags=re.IGNORECASE) is None
+ assert re.search(r"\sstyle\s*=", html, flags=re.IGNORECASE) is None
+ assert re.search(
+ r"]*\bsrc=)[^>]*>", html, flags=re.IGNORECASE
+ ) is None
+ assert re.search(r"\son[a-z]+\s*=", html, flags=re.IGNORECASE) is None
+ assert 'href="styles.css"' in html
+ assert 'src="i18n.js"' in html
+ assert (
+ '' in html
+ )