diff --git a/.vscodeignore b/.vscodeignore
index 682b1e7..8e0d2ad 100644
--- a/.vscodeignore
+++ b/.vscodeignore
@@ -2,4 +2,8 @@
 node_modules/**
 *.vsix
 CONTRIBUTING.md
+CODE_OF_CONDUCT.md
 .gitignore
+.github/**
+scripts/**
+tests/**
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8e24457..d71742a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,7 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Dispose previous Sidebar webview message listener on view reopen to prevent memory leaks (Fixes #30).
 - Add configurable Weekend Streak Protection (codecritter.weekendStreakProtection) to protect streaks over Saturday and Sunday (Fixes #31).
 - Clean up corrupted Unicode Mojibake artifacts in media/sidebar.html (Fixes #28).
+- Update .vscodeignore to exclude internal scripts/tests/CI and add Content-Security-Policy to sidebar webview (Fixes #29).
 
 ---
 
diff --git a/media/sidebar.html b/media/sidebar.html
index 337164c..aa5dab1 100644
--- a/media/sidebar.html
+++ b/media/sidebar.html
@@ -3,6 +3,7 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline';">
 <style>
   :root {
     --pet-body:      __THEME_BODY__;
diff --git a/tests/sidebar.test.js b/tests/sidebar.test.js
index e48d047..6afd77e 100644
--- a/tests/sidebar.test.js
+++ b/tests/sidebar.test.js
@@ -112,3 +112,19 @@ test('Issue #28: media/sidebar.html renders clean UTF-8 emojis without Mojibake
   assert.equal(sidebarHtml.includes('dY"S'), false, 'must not contain Mojibake dY"S');
   assert.equal(sidebarHtml.includes('📊 Full Dashboard'), true, 'must render standard 📊 Full Dashboard button');
 });
+
+test('Issue #29: media/sidebar.html includes strict Content-Security-Policy meta tag', () => {
+  const sidebarHtml = fs.readFileSync(path.join(__dirname, '..', 'media', 'sidebar.html'), 'utf8');
+  assert.match(
+    sidebarHtml,
+    /<meta\s+http-equiv=["']Content-Security-Policy["']/i,
+    'sidebar.html must define a Content-Security-Policy'
+  );
+});
+
+test('Issue #29: .vscodeignore excludes internal scripts, tests, and CI workflows', () => {
+  const vscodeignore = fs.readFileSync(path.join(__dirname, '..', '.vscodeignore'), 'utf8');
+  assert.ok(vscodeignore.includes('scripts/**'), '.vscodeignore must exclude scripts/**');
+  assert.ok(vscodeignore.includes('.github/**'), '.vscodeignore must exclude .github/**');
+  assert.ok(vscodeignore.includes('tests/**'), '.vscodeignore must exclude tests/**');
+});