Fix security warnings from sobelow

.check.exs

@@ -18,6 +18,7 @@
     # {:my_mix_task, command: "mix release", env: %{"MIX_ENV" => "prod"}},
     # {:my_arbitrary_tool, command: "npm test", cd: "assets"},
     # {:my_arbitrary_script, command: ["my_script", "argument with spaces"], cd: "scripts"}
-    {:excoveralls, command: "mix coveralls --trace"}
+    {:excoveralls, command: "mix coveralls --trace"},
+    {:sobelow, command: "mix sobelow -i Config.HTTPS"}
   ]
 ]

lib/live_deck_web/live/control_live.ex

@@ -23,17 +23,17 @@ defmodule LiveDeckWeb.ControlLive do
     {:ok, socket}
   end
 
+  def render(assigns) do
+    Phoenix.View.render(LiveDeckWeb.ControlView, "index.html", assigns)
+  end
+
   def handle_event("toggle_menu", _, socket) do
     case socket.assigns.menu_class do
       "" -> {:noreply, assign(socket, menu_class: "hamburger--close", menu_drawer: "menu--open")}
       "hamburger--close" -> {:noreply, assign(socket, menu_class: "", menu_drawer: "menu--close")}
     end
   end
 
-  def render(assigns) do
-    Phoenix.View.render(LiveDeckWeb.ControlView, "index.html", assigns)
-  end
-
   def handle_event(action, _, socket) when action in @valid_actions do
     {:noreply,
      action

lib/live_deck_web/router.ex

@@ -7,7 +7,7 @@ defmodule LiveDeckWeb.Router do
     plug :fetch_session
     plug :fetch_live_flash
     plug :protect_from_forgery
-    plug :put_secure_browser_headers
+    plug :put_secure_browser_headers, %{"content-security-policy" => "default-src 'self'"}
     plug :put_root_layout, {LiveDeckWeb.LayoutView, :root}
   end