diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 1949d44..7354094 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -2,3 +2,8 @@
 **Vulnerability:** Use of `innerHTML` for dynamic content and missing Content Security Policy (CSP).
 **Learning:** Even if the content is currently static, using `innerHTML` is a dangerous pattern that can lead to XSS if the application grows. Prefer `textContent` and explicit DOM node creation.
 **Prevention:** Establish a strong CSP and enforce secure DOM manipulation practices through documentation and code reviews.
+
+## 2025-05-15 - CSP Meta Tag Constraints & Dynamic Button Types
+**Vulnerability:** Weak default-src in CSP and implicit button types for dynamic elements.
+**Learning:** The `frame-ancestors` directive is ignored when delivered via a `<meta>` tag; it must be set via an HTTP header. Additionally, dynamically created buttons should always have an explicit `type="button"` to prevent accidental form submission if the DOM structure changes.
+**Prevention:** Use `default-src 'none'` as a baseline and always explicitly set button types. Be aware of meta-tag CSP limitations.
diff --git a/index.html b/index.html
index c11f76f..58c6668 100644
--- a/index.html
+++ b/index.html
@@ -3,7 +3,7 @@
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'sha256-fgxmLOznNmVf4GAd24jy5Eiv/Rer+7sVLOBqnsVx0nY='; script-src 'self' 'sha256-cPRnZP+O4z5KsN+vdFstQwgKExGtoN98I3Gq+Tm1aSA='; object-src 'none'; base-uri 'self'; upgrade-insecure-requests;">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'self' 'sha256-fgxmLOznNmVf4GAd24jy5Eiv/Rer+7sVLOBqnsVx0nY='; script-src 'self' 'sha256-zIaCm2aUZ8bF/BDuRAXJ6hXOL+/WioI9n16eXnrr1rE='; object-src 'none'; base-uri 'self'; form-action 'none'; upgrade-insecure-requests;">
   <meta name="referrer" content="no-referrer">
   <title>5ive - UX Sample</title>
   <style>
@@ -167,6 +167,7 @@ <h1>Welcome to 5ive</h1>
         feedback.appendChild(content);
 
         const closeBtn = document.createElement('button');
+        closeBtn.type = 'button';
         closeBtn.className = 'close-btn';
         closeBtn.setAttribute('aria-label', 'Close notification');
         closeBtn.textContent = '×';
