Changeset 73abbfd in Klonkt for src/views

Timestamp:

06/28/2026 01:55:31 PM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

be5d86c

Parents:

9910ba1

Message:

experiment(csp): strict script-src (nonce + strict-dynamic) — BETA canary

Drops 'unsafe-inline' + broad host sources from script-src; a per-request nonce is injected into
every <script> at render time and 'strict-dynamic' covers htmx-swapped + player-API scripts.
Testing on BETA only first — htmx nav / embeds may break under the strict policy; do NOT roll to
the fleet until validated.

(No files)