{"action":"created","issue":{"url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/228","repository_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge","labels_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/228/labels{/name}","comments_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/228/comments","events_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/228/events","html_url":"https://github.com/linuxfoundation/cii-best-practices-badge/issues/228","id":136086930,"number":228,"title":"Lock down Content Security Policy (CSP)","user":{"login":"david-a-wheeler","id":813150,"avatar_url":"https://avatars.githubusercontent.com/u/813150?v=3","gravatar_id":"","url":"https://api.github.com/users/david-a-wheeler","html_url":"https://github.com/david-a-wheeler","followers_url":"https://api.github.com/users/david-a-wheeler/followers","following_url":"https://api.github.com/users/david-a-wheeler/following{/other_user}","gists_url":"https://api.github.com/users/david-a-wheeler/gists{/gist_id}","starred_url":"https://api.github.com/users/david-a-wheeler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/david-a-wheeler/subscriptions","organizations_url":"https://api.github.com/users/david-a-wheeler/orgs","repos_url":"https://api.github.com/users/david-a-wheeler/repos","events_url":"https://api.github.com/users/david-a-wheeler/events{/privacy}","received_events_url":"https://api.github.com/users/david-a-wheeler/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-02-24T15:03:58Z","updated_at":"2016-08-31T02:38:10Z","closed_at":null,"body":"The current Content Security Policy (CSP) is loose because our reused components don't work with a more locked-down version.  Try to lock the policy down further; this may require replacing some reused components or working with some of our component providers to make changes.\r\n\r\nThe CSP policy is configured in config/initializers/secure_headers.rb.  For information on the secure_headers gem (maintained by Twitter), see <https://github.com/twitter/secureheaders>.\r\n\r\nYou can see the current header status by viewing: <https://securityheaders.io/?q=https%3A%2F%2Fmaster.bestpractices.coreinfrastructure.org>.\r\n\r\nThis is a related follow-on issue from issue #103."},"comment":{"url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/comments/243642031","html_url":"https://github.com/linuxfoundation/cii-best-practices-badge/issues/228#issuecomment-243642031","issue_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/228","id":243642031,"user":{"login":"david-a-wheeler","id":813150,"avatar_url":"https://avatars.githubusercontent.com/u/813150?v=3","gravatar_id":"","url":"https://api.github.com/users/david-a-wheeler","html_url":"https://github.com/david-a-wheeler","followers_url":"https://api.github.com/users/david-a-wheeler/followers","following_url":"https://api.github.com/users/david-a-wheeler/following{/other_user}","gists_url":"https://api.github.com/users/david-a-wheeler/gists{/gist_id}","starred_url":"https://api.github.com/users/david-a-wheeler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/david-a-wheeler/subscriptions","organizations_url":"https://api.github.com/users/david-a-wheeler/orgs","repos_url":"https://api.github.com/users/david-a-wheeler/repos","events_url":"https://api.github.com/users/david-a-wheeler/events{/privacy}","received_events_url":"https://api.github.com/users/david-a-wheeler/received_events","type":"User","site_admin":false},"created_at":"2016-08-31T02:38:10Z","updated_at":"2016-08-31T02:38:10Z","body":"Here's a fake PR: https://github.com/linuxfoundation/cii-best-practices-badge/pull/486\r\n\r\nIf you have any idea on why the test is failing, let me know.  It seems to be a problem in the test; using it \"live\" seems to work fine.\r\n"}}
{"actor":{"display_login":"david-a-wheeler"}}