fixed content sec policy and github img