[BUG] Site doesn't work

[sgpinkus]

Describe the bug
Site doesn't work on Firefox or Chromium.

To Reproduce

1. Browse to index page.
2. Click either of the "Guidance" links.

Expected behavior
Shown some guidance.

Actual Behaviour
Nothing happens.

Desktop (please complete the following information):

• OS: Debian Linux
• Browser: Firefox 140.3.1esr (64-bit)

Additional context
Get these errors:

Content-Security-Policy: The page’s settings blocked the loading of a resource (frame-src) at https://buttons.github.io/buttons.html#href=https%3A%2F%2Fgithub.com%2Fowasp%2Fwww-project-secure-headers%2Fsubscription&title=&aria-label=Watch%20on%20GitHub&data-icon=octicon-eye&data-text=Watch&data-size=large&data-show-count=true because it violates the following directive: “frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com” index.html
Content-Security-Policy: The page’s settings blocked the loading of a resource (frame-src) at https://buttons.github.io/buttons.html#href=https%3A%2F%2Fgithub.com%2Fowasp%2Fwww-project-secure-headers&title=&aria-label=Star%20on%20GitHub&data-icon=octicon-star&data-text=Star&data-size=large&data-show-count=true because it violates the following directive: “frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com” index.html

[righettod]

Hello,

Thanks for raising the issue 👍

I'm able to reproduce the error on Chromium (Windows 11) and Firefox (Kali + Windows 11). On Chromium, site is still functional but not on Firefox (both platforms).

As we do not control, at the GH project level, the CSP header, We will see with technical people from the foundation how to fix this issue.

ChromiumOnWin11.mp4

FirefoxOnKali.mp4

Thanks again for the notification.

[righettod]

Note

Slack thread link: https://owasp.slack.com/archives/C66R5JF6V/p1760723243472669

I started a exchange with the other projects leaders about this issue on the OWASP Slack:

[righettod]

The import of GA script come from the site template: https://github.com/OWASP/www--site-theme/blob/main/_includes/head.html

I asked how to drop it and I'm waiting the feedback from the foundation.

[righettod]

CSP issues are now fixed but it still doesn't work well on firefox, I will continue to investigate to fix the issue.