Improve Content Security Policy by removing unsafe-inline

[oliverames]

Current State

The CSP at line 55-63 includes:

• script-src 'self' 'unsafe-inline' https://unpkg.com
• style-src 'self' 'unsafe-inline' ...

The 'unsafe-inline' directive weakens the CSP significantly, allowing inline scripts/styles which could be vectors for XSS attacks.

Why It Exists

All JavaScript and CSS is currently in the single index.html file, requiring 'unsafe-inline' to function.

Proposed Solution

1. Extract JavaScript to app.js
2. Extract CSS to styles.css
3. Add nonce-based CSP for any remaining inline scripts
4. Remove 'unsafe-inline' from CSP

<meta http-equiv="Content-Security-Policy" content="
    script-src 'self' 'nonce-{random}' https://unpkg.com;
    style-src 'self' https://fonts.googleapis.com ...;
">

Trade-offs

• Requires build tooling or manual file splitting
• Conflicts with the intentional single-file architecture
• May not be worth it for a demo/portfolio project

Priority

Medium - The current CSP still blocks most attack vectors. This is a hardening measure for production use.