Recorded on 2026년 11월 2일
Close a hardening gap from the threat model
Coroid Expo's content security policy still allowed inline styles, a relaxation its own threat model listed. Coroid removed it without breaking the fonts visitors read in Arabic, Japanese and Chinese, and QA proved it in a real browser.
- To the pull request
- 43 min
- To the merge
- 7 h 57 min
- Agent runs
- 7
- Criteria verified
- 8 of 8
- Model spend
- US$0.51
- Change
- 11 files, +307 −44
What was asked
Remove style-src 'unsafe-inline': styles from 'self' only and script-src unchanged. The locale fonts must still load in Arabic, Japanese and Chinese with no policy violation in a real browser, a test must fail if 'unsafe-inline' comes back, and the threat model must be updated.
What happened on the way
The plan turned the requested three-locale browser check into a check of one font, every planned criterion passed, and the pull request went out without it. Review caught the gap against the filed criteria. One requested change added a three-locale browser test with screenshots, and QA verified it in each locale.
The outcome
Merged. The policy sends style-src 'self' with script-src unchanged, the fonts load from a constructed stylesheet instead of style elements, the 2D mode renders in all three languages with no policy violation, and the security tests fail if 'unsafe-inline' returns. The threat model no longer lists the relaxation.
The record
- Pull request #200Made by CoroidMerged as 232f83692
- 2 tasks recorded in Coroid
The repository is private, so this record names its pull requests and does not link them.