From 5e041686299b7fadc81de7972ddff496fab02a23 Mon Sep 17 00:00:00 2001
From: lauriliikane <lauriliikane@gmail.com>
Date: Tue, 18 Aug 2026 20:30:18 +0000
Subject: [PATCH] Security: remove public zipper/unzipper tool, add CSP and
 workflow least privilege

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .github/workflows/add-issue-to-project.yml |   5 ++++
 SECURITY.md                                |  27 ++++++++++-----------
 index.html                                 |  16 ++++++------
 zipper-unzipper.zip                        | Bin 3757 -> 0 bytes
 4 files changed, 27 insertions(+), 21 deletions(-)
 delete mode 100644 zipper-unzipper.zip

diff --git a/.github/workflows/add-issue-to-project.yml b/.github/workflows/add-issue-to-project.yml
index e3984c6..db41631 100644
--- a/.github/workflows/add-issue-to-project.yml
+++ b/.github/workflows/add-issue-to-project.yml
@@ -3,9 +3,14 @@ on:
   issues:
     types: [opened]
 
+permissions: {}
+
 jobs:
   add-to-project:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      repository-projects: write
     steps:
       - name: Add issue to project
         uses: actions/add-to-project@v1
diff --git a/SECURITY.md b/SECURITY.md
index 034e848..183ab17 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,21 +1,20 @@
 # Security Policy
 
-## Supported Versions
+## Scope
 
-Use this section to tell people about which versions of your project are
-currently being supported with security updates.
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 5.1.x   | :white_check_mark: |
-| 5.0.x   | :x:                |
-| 4.0.x   | :white_check_mark: |
-| < 4.0   | :x:                |
+This repository contains the static website published at https://leksiko.eu
+(HTML/CSS and a small amount of client-side JavaScript). There is no backend
+code, database or build pipeline in this repository.
 
 ## Reporting a Vulnerability
 
-Use this section to tell people how to report a vulnerability.
+Report suspected vulnerabilities by e-mail to lauri@leksiko.edu.ee, or privately
+via GitHub Security Advisories ("Report a vulnerability" on the Security tab).
+
+Please include the affected URL or file, steps to reproduce, and the impact you
+observed. You can expect an initial response within 7 days. Accepted issues are
+fixed on `main` and deployed with the next site update; declined reports get a
+short explanation.
 
-Tell them where to go, how often they can expect to get an update on a
-reported vulnerability, what to expect if the vulnerability is accepted or
-declined, etc.
+Please do not open public issues for security reports, and do not run automated
+scans or load tests against the live site.
diff --git a/index.html b/index.html
index eb4c6b4..915896e 100644
--- a/index.html
+++ b/index.html
@@ -4,6 +4,8 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="description" content="Wordpress, Joomla, Drupal ja teised" />
+  <meta name="referrer" content="strict-origin-when-cross-origin" />
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; script-src 'self' 'unsafe-inline'; connect-src https://formspree.io; form-action https://formspree.io" />
   <title>Avatud koodiga tarkvara: koolitused, kood, sõnastik</title>
   <link rel="preconnect" href="https://fonts.googleapis.com" />
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
@@ -479,9 +481,9 @@ <h2>Tehtud tööd</h2>
           <div>
             <strong>Eestikeelsed Wordpressi ja Githubi juhendid spetsialistile</strong>
             <span>AI abil koostatud ja inimese poolt üle kontrollitud juhendid asjatundjale.</span><br />
-            <a href="https://github.com/liikane/wp-juhendid" target="_blank">Juhendid</a>
+            <a href="https://github.com/liikane/wp-juhendid" target="_blank" rel="noopener noreferrer">Juhendid</a>
             <span> · </span>
-            <a href="https://github.com/liikane/homepage" target="_blank">Markdown süntaksi näidised</a>
+            <a href="https://github.com/liikane/homepage" target="_blank" rel="noopener noreferrer">Markdown süntaksi näidised</a>
           </div>
 
           <span class="tag">Juhendamine</span>
@@ -490,9 +492,9 @@ <h2>Tehtud tööd</h2>
           <div>
             <strong>Tulemused</strong>
             <span>Mõned värskelt valminud või uuendatud lehed.</span><br />
-			<a href="https://klaaskajak.ee/" target="_blank">Wordpress leht nullist: uudse klaaskajaki pakkumine</a>
+			<a href="https://klaaskajak.ee/" target="_blank" rel="noopener noreferrer">Wordpress leht nullist: uudse klaaskajaki pakkumine</a>
             <span> · </span>
-            <a href="https://www.ubari.ee/" target="_blank">Eksootilise sisuhaldussüsteemi seadistamine koos kliendiga: loodusturism</a>
+            <a href="https://www.ubari.ee/" target="_blank" rel="noopener noreferrer">Eksootilise sisuhaldussüsteemi seadistamine koos kliendiga: loodusturism</a>
           </div>
           <span class="tag">Valmis</span>
         </div>
@@ -516,18 +518,18 @@ <h2>Kirjuta ja küsi nõu</h2>
           <div class="field-grid">
             <label class="field">
               <span>Sinu nimi</span>
-              <input type="text" name="name" placeholder="Nimi siia" required />
+              <input type="text" name="name" placeholder="Nimi siia" maxlength="100" autocomplete="name" required />
             </label>
 
             <label class="field">
               <span>E-post</span>
-              <input type="email" name="email" placeholder="minu@mail.ee" required />
+              <input type="email" name="email" placeholder="minu@mail.ee" maxlength="254" autocomplete="email" required />
             </label>
           </div>
 
           <label class="field">
             <span>Sõnum</span>
-            <textarea name="message" rows="6" placeholder="Kirjuta oma soov või küsimus siia. Palun ka telefoninumbrit igaks juhuks" required></textarea>
+            <textarea name="message" rows="6" maxlength="5000" placeholder="Kirjuta oma soov või küsimus siia. Palun ka telefoninumbrit igaks juhuks" required></textarea>
           </label>
 
           <button type="submit" class="btn btn-primary contact-submit">Saada sõnum</button>
diff --git a/zipper-unzipper.zip b/zipper-unzipper.zip
deleted file mode 100644
index 1911253da81f51bba5f122da5cce444bbb59ca34..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 3757
zcmZ{n_dgVX8^`aCJF*hl;f%!H;gE4UdlYAdGsD?V<ZN+dL`2FtiOe!iHpwQPJ+eZw
zBdL&;?7n@+>-*F9`#i7L^Ld`<^ZWtN+XO>Hdl3Kt&;#^eXW3wvDtCY^0Kkqk0Koot
z8;U0oT>T^i@BF)wB6twK*m#>QE3lsBIOO}|*=@XNHqvfG8%=xb6#c=F2BR=Ve%<P{
z&KT#$rywqyv#{V_PSd_@i$^>8u5qGIEt*Ti@4hAxw`6ly%C~lhZCCvLP>w6!LFp?f
zIQ=n{kylRx<N<AgYG^QOCVG%&ks2PHsW{?wT|EY4v`D>|xRo!J;R3XBsz$Pxma;0!
zlY+`kd6t@l@o09`Hn7TM<JB>Uk7SDW#g*K_izTeMJT1=ZzE2`!R(h`Mn$ukrdl_vs
zEh$}bv)V<!CrKM^Xf4W~<IVQ)$l5ODdEP;`LB`mI3G|vd2c<8lirp(!n=O+eFY60R
z8u#gD2gRVq7v*~C;mh_yITWyZ1(_J7`ve1f(Z`v;)9Nx>c|g-f1LN?`)JCu;5%29h
zCEnYQn<bWH`t#bwOvYLG<**#mO_*VC)7iYU7}VA4R^G^keC4V%HvVK=P_8`l{J4A)
z@?QUj&5bdUaZ#9(LV(op0!v=l^08v^0)Ja$$O427#lGPX^^g;s9sFT2V_V_1+xnY;
zvk1nPQN8=Pnp)q$pitk#HhzDd*|R|Z)RTE(QKr7p`#MvL4X>(wI-t?{SF8+labl7n
zCZ4x>%vzA0@3T>mImX#OjIc|}iX|zztL97!U;jJBl4;jS_Mw!|R?ON^Nfu(~_Wreq
zLYb2Y`>HHXuRK%0VQ|@JTls1n^?1_M7Asi?JTJ~fCUzG!W~B!dInR~BZ6F)r-oO3D
z+)5rAI&;25#w6{ZZSKFHI@`}_KQ8?FbNygA*BJu;!RKdE;2l3B3YAGKTR#14eERYC
zy)AYhcHSAK8|R3{;>~s;szwi!vxhADSjusr6xZ!BWGCI4I5h6Fk={3Uu2$O>IP~?6
z0J5o2Kf&CZbt04OxI4`{mgrT0eu2+YzX%seQz?vl!TYNs?CJnHxNid6DOdFeLE_(#
zb9PsUE;4ouCN@U5pc5)Mgzre8%c!_Kh?A06=bCp86*21KN1|`{nfTzCe|G1}TC$Nl
zwV@D@pdPgx_1(Jiy1m9e%Q|2{U?bN>q@u?=rItD%XrJ4n+{$}GL@8-J`6$|&v+u{J
z`>9>+4Ek6=x$XF43XV(Byu|*D2V+&=a$U)EeIN7U*y8k>ej~11Y)!=-oNB;`RxD+k
zT6Ez1Iwsbticg2n9#q^~3;39X#MP5+R~d$^&Yg>FW6Z2Euevgzy5yp961^9Bi(ut2
zj*?NbiIX&BKX>!4Rw|jrjMH3xEcf8NAgqMGU?QVio}(@W<l|fy+gPIBEfZQ2-NiY2
z&LtgCaZLY|>GGcYMH0I2MF6LW#Ewo*)d>(&+i(2UGVWH4shKu2uGER)sU}}<$zEyR
zeS{NOYBvay=5>O;McRBE8{C;11U{df;nH<+(&_RW(xx(NsTTZZgX1Lc;u`?%akrsD
zh=2@j3QBvVf<a4Fw+kb%E0y7gWM>J`)o2<6X~-wC`Nn>8b)DRC54GFy>`cE9`f#-5
zDy?Gz1#76?Wt+KU%lT44%Z<aSS`J6D`!+~Ow#t~avQKKVqZZ1(D``ZZ1hxuug3PYa
zc!=liV?<p{ON6BL6BGWp=|g3)vQ*Q`Ub<zFtH+o>WAw{A73aEnJ}ab*-lv%O<s?yX
zp()>;FyqZ8VV6AT;qWTIMOKre(Dv@T#QKNZzoC0rQp6=&^))PU7{4vUuu#w25jrTW
z3NBz1eyv(SKjrE*L>m`ZJ3^wbgPHT){)Cnl5D1F#!+V=8D%}5)^QwtUeChf`pe2K%
zcJYR29kyGog<SJuG1eYKcTkIoSgMWAIwe?aZaKZD-Bc+Twt0M{Y-6p$DCVwX;hR*E
zH6+l7Z&<L&^8fZ+o019a=rrWWI0#2DVBp^$o-1`xnbwKmU>6yl(WEg4w*gzL(;WT1
z!DDb8=Ak-JcX4`)+2aAQEH+r9^@I|tJNUuEz8SdNf5fZ4u=mIfulxt2V>UkC^G3mP
zUUEY{&YvqB(=QDFEwcP0-VJJmdPbX;gt$CcspqDN&3>S8<RB>lA>@Lf!FbtDiaU?8
ze9#leyXh2}Hfq@sAFH$G1#z+qBd5g)4IrvpeF|MA)fRf{M({gWe!KOF`-f=M%}|y!
z8GD&Mri?j(<coT8154wuNE#pCTctJavm-{9rbw@A7E<d?_3ejEPW37J!p&WB%Wse#
zk<DLftrPq~2o7^H+VE@d>rD3OxZr%dY)(lyUG=ci@2F|ju`kR-8y4gK9+o(VWno>h
z@7!$f#gRUBcBW!8g`Z74%np#vZ}KK)i`3Stzu4l(AVnLzkzd(8hrhpH{3?^SCq%O`
zWyEsvLE7!er@y!n6+8hr6_0Wkrv^t`YRjxq6hF^7!jm7s;R3y&(*yk6pX{|epWg|?
z#ZO;@n7_Bjg38P2|2TyFAqbrWrzJtZIf(O=)(bMGiJ<bdOFrx(XH;Y*K2p9K77R8!
z(ob<{bh{`OPA3%!4QMW26y>3$74@?LpM*S9b`}eppFkE)*G>J2T6nR|?07keMe~zG
zHK$6oK$pZXSXT2~sP9qbhXO<l0DI*%<?#ZY2vdMr-N7Z_5kbW#msL1I*IOVqMdjKJ
zSozJ?)53zYU!GI(wzrJW!hT6v-Nv?twG)Vc-d~#kA(nFmVevpx*sz;D<NeYzn33*B
zW!M4v88P2a(PK5KUz%1?gilX(dU|?(=CCOAisEw?y#5mMUjKnoep+Ho@RzzMtu3n3
zWM0ukCUdy|$4U?)>ZMS8^VK-VC-I&=4Q-xNot$>V0BzsAI}_OGXIs|1%R<j8R5J%*
z$Cw&NPq%^XY*ohbUazY?VPxz16`JoDG$krf3s9+u;2TJA4FCl>f$gL9>2LWX-0_dp
z)Ey<Y${`#drAd4ZNSn@ZxgiXTeo)foH@)sb47SX6{Z!EwQHaEszy$tQ6Y8r(*1*d(
zGOuRIYfA%F3^H1|`f<1mk>J)c4d=kv2Z;{ox1$#b*((!A%(N<ImijBT!|~x1Rpt_t
zi5p+_Irc3r13k3P+>f}Y<Wd<Fb#sg|cart^Cs(UnL<Px9*`pos_%K>GPhlisaANRk
zFq2(;hmk}T-rIYSS6if-ug2uqy8SSmHCgS|VD>s#JCN1gCGtV0@a)R@<<L(<F<2PW
z)_prWH3ipZtp*z=<#0>7B^uWP8;(~u-z-o-8swM+BkSUfs!wHNtF}PJGrQAf-||no
z4<3*nfb>)1HP~l&(;pGVCc@WO&ph{T(o7_k$NQVjWV{u`ZpvPEpwUde(hF9Z+BQet
zBy)`+p}Bo*2*EPWp>=q_52}RYi8{VAzu}d4<s7uxcru})_8oKRLR^A#&YOGk0b4}S
zaG>y@o0hBbDX)73Km6PKoE4O7JuF~ubM$a=%g=-~_3|SOFefHbTHDc@Td2-hM!yX%
zo%2rF80vx-7AGk@CssOjjg)TuiYh~-jp!Peq)Nd8Qz9DUx?ICw?FYRli4AYsO8<R%
zI%=24Uk*6DhnNT%j7R)<8_~fqLf1r-(M$d%(=qo0=<w`BnI2pD;<>CIHf^bP!L845
z_}b@;`w2(syIFTd$Bb3ZPj#}!uBXxm4S-(l)TdXTaOHd!Ub#f8$L%C8B4mDkPh~g!
zmvirO<2BPIsFQZFp7Ku;RXAVbS*F{&2ceQY)_`ag>D?<#@Rw54ciT?!8zJYULac54
zlGsy<FE%g(nFg8@B)p)c!F2Rb(%i<0)*~R<8qXwm6aD%jSX(pQ>*ow4L<C=EKeDxi
zg_Rwv@-RUHSMzv~Vl%6yVnQZ9r%FK7qYL!SD~+aI8JeQOOxzm?1DTO+=k99>GmN`@
zeiDZt463CVCv0Ks;9gIIaRWk!z%^twx3)SV!jDL7G0<5M%*xHpNzYV}w5<BLBQIIc
zPMJv0aI`F)B>QgfuXzxBt9APuBI`Xo(LRAEZ(YWU#ZA)Hx;9pS8uoACDskh5JF@m~
zDM#paqodzxn}pXQ+&@cM!8=82w8rd&o~0#6>XLL;yHBc>5md?^(H#+43P#>3>f1lE
zs=ixQUthoYa+;9YD_?QAGSJE;6V}!an?_9EIF<At*yR{C3~H}Yk-8p)RnC;2NmyLz
zA>6=HhNMF!oCj7%vk8RBrs;KEhaT#j>7lhy73%9bsN04lWWkb~2lj+EiADZ~AQbw}
z^3JfHLB))frB6N^r=gORCTW<p>DrXnJYGt=3YwB09^1h6sssb0GD4vBE@a*SBtrAi
z5^AUn2Agj^v+nS{`;K>&ZC<ZbcEYDbh{j6CF)hAJBmNR00!75_v7N^04DZq-<k$s%
zqlvM`(mb5RA(+hcw;!;Ma!VYAf4nqbAY>oCyBRapZZgueXLyVFhHiWlY!mD`r9#hf
zojMnJ^(iV@E$UfJ5C8BdZL|EH19yX^WZY~bDKiH3DC&WJY^C8>{;f;Q<2~~+Bj}LC
zVqxh=q4`f|ug2c3qyG3&>lUm(J&M3LH6q7FshS_k$8$0R`bx4&sREDhyLs8G4AW$A
zuTJJ|60ZW)V&cg+4U7Y5Sw$tzIFZC?X?Q7@T<f=63A0R#`oOj8B#L4jGPP>VFA#+U
zZ}ESgmih37+kU8zQXpCEY(F4B?%S$(HCv;e0qOK^h%qpzDdd)5_Rq<lqM%+LqLkWf
zNRtn4w&xIXePaKr@it4+0o`0}H|pnPBP4>lUYduuFt2p5Xe=s(SgcC=-iI?A=K~i^
zriSi;OfW!@8sPsiqv&61{AWP_RsSbJGW^E`0=NNfIXnpg4Ku+1T>n>0Fkr|(2jJgy
M{j0Knp%ei42lf>7{Qv*}