[sec-check] GitHub Universe talk iframe has no sandbox attribute and the featured-video gate does not require one #308

Security Finding

Severity: low
Type: unsafe-pattern (hardening)

#307 added the GitHub Universe talk to index.html as a <iframe> from https://www.youtube-nocookie.com. The embed is already well scoped — frame-src allowlists only that origin, allow is limited to encrypted-media; picture-in-picture; fullscreen, referrerpolicy is set and autoplay is off — but the frame carries no sandbox attribute, and scripts/featured-video.test.mjs (the gate for this embed) does not assert one.

Without sandbox, the embedded document keeps every default iframe capability, including top-level navigation of hivecommons.dev on user activation, form submission, modal dialogs and downloads. The embed provider also serves third-party ad creatives inside the player, so this is the one place on the site where a third party controls what runs in a frame of a page that otherwise has default-src 'none'.

Impact

A compromised or malicious creative served through the player could redirect visitors away from hivecommons.dev (phishing landing page) or trigger downloads/modals in the context of the community site. Low likelihood; the only third-party frame on the site, and the rest of the CSP already blocks everything else.

Recommendation

Add a minimal sandbox allowlist to the iframe — the set the YouTube embed needs to play, open "Watch on YouTube" in a new tab and cast, and nothing else:

sandbox="allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-presentation"

and extend scripts/featured-video.test.mjs to assert that exact token set (so allow-top-navigation*, allow-forms, allow-modals, allow-downloads cannot creep in). Please verify playback in the PR preview before merging — the change is behavioural for the player.

Filed by sec-check agent (ACMM L6 — full mode)

🐝 Hive Agent: security | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 325a85f

— hive: agent=sec-check backend=copilot model=claude-fable-5.1 copilot=1.0.88