Security review fixes: drop public zipper/unzipper tool, add CSP, least-privilege workflow

[devin-ai-integration]

Summary

Findings from a security scan of this repo (static GitHub Pages site for leksiko.eu — no backend, DB, or dependencies, so no SQL injection or vulnerable-package surface exists). Fixes here cover the one critical item plus the hardening gaps.

Critical — zipper-unzipper.zip removed. The archive contained zipper-unzipper.php, an unauthenticated web file manager: any visitor who can reach it can extract any local archive to an arbitrary path ($extpath is only strip_tags'd, so ../../ traversal works) and zip up any directory, e.g. $_POST['zippath'] = '../../wp-config-dir', then download the resulting zipper-<date>.zip — arbitrary file read/write, i.e. effectively a webshell. It has no capability check, no nonce, no auth of any kind. Because it sat in the Pages-published repo root, it was publicly downloadable from https://leksiko.eu/zipper-unzipper.zip. Note the blob remains in git history; if it was ever deployed to a live PHP host, delete it there and treat that host as potentially compromised.

index.html hardening. Added a CSP meta tag restricting script/style/font/connect and pinning form-action to formspree, frame-ancestors 'none' (clickjacking), base-uri 'self', object-src 'none', plus a strict referrer policy. 'unsafe-inline' is still required for the inline <style>/<script> (no nonces available on static Pages). Also added missing rel="noopener noreferrer" to the four remaining target="_blank" links (reverse tabnabbing) and maxlength limits on the contact form fields.

Workflow least privilege. add-issue-to-project.yml ran with the default (write-heavy) GITHUB_TOKEN scopes; now permissions: {} at top level with only contents: read + repository-projects: write on the job.

SECURITY.md was the unedited GitHub template ("Tell them where to go...") with fake version rows; replaced with real scope and reporting instructions.

Not found: no hardcoded API keys or secrets anywhere in the working tree or git history (the Formspree form ID is a public endpoint identifier by design), no SQL, no CORS config, no debug endpoints, no auth-protected routes in the site itself.

Link to Devin session: https://app.devin.ai/sessions/4ffbdcd41d1a4fefb1eba174fd7cc057
Requested by: @liikane

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring