Question: do we want set up Content Security Policy? It's a security standard helping with all bad stuff bad people could do with a website, including clickjacking, malicious XSS and other. I was really encouraged to implement it on my last year web security workshops, but honestly I have no experience with that other than this workshop.

Implementation would be extremely easy, just adding one line to server in nginx config:

add_header Content-Security-Policy "default-src 'self';";

Adjusting current codebase wouldn't be hard too. Mostly because we don't have a lot of code right now. ;)