From 61ed761614da993f53dc6a7101d0ef94b32910f2 Mon Sep 17 00:00:00 2001
From: David Sanders <dsanders11@ucsbalum.com>
Date: Tue, 5 May 2026 16:15:22 -0400
Subject: [PATCH] security: tighten up our CSP

---
 static/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/static/index.html b/static/index.html
index bf0d0df1f5..06c99c8af1 100644
--- a/static/index.html
+++ b/static/index.html
@@ -4,7 +4,7 @@
   <meta charset="utf-8" />
   <meta http-equiv="X-UA-Compatible" content="IE=edge">
   <title>Electron Fiddle</title>
-  <meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data:; media-src 'none'; child-src 'self'; object-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https: sentry-ipc:; font-src 'self' https:;">
+  <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests; default-src 'none'; img-src 'self' https://avatars.githubusercontent.com data:; media-src 'none'; child-src 'self'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://*.algolia.net https://api.github.com/gists/ https://api.github.com/gists https://api.github.com/user/ https://api.github.com/user sentry-ipc:; font-src 'self'; base-uri 'none'; form-action 'none'; worker-src 'self'; manifest-src 'none';">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <style id="fiddle-theme"></style>
 </head>