Index: src/server.js
===================================================================
--- src/server.js	(revision 015ce465e5c0358e84f12cd2ca3297d32e390cee)
+++ src/server.js	(revision 9effb80995066fd31d07a2d3669248119426209d)
@@ -105,5 +105,8 @@
       scriptSrcAttr: ["'unsafe-inline'"],
       styleSrc: ["'self'", "'unsafe-inline'"],
-      imgSrc: ["'self'", "data:", "https:"],
+      // blob: nodig voor de afbeeldings-editor (Cropper) — die toont de gekozen
+      // foto via een URL.createObjectURL(blob:…). Zonder blob: blokkeert de CSP
+      // de <img> stil → leeg bewerk-venster. (media-src heeft blob: al voor audio.)
+      imgSrc: ["'self'", "data:", "https:", "blob:"],
       connectSrc: ["'self'", "wss:", "ws:", "https://*.spotifycdn.com", "https://*.scdn.co"],
       // blob: is required for the audio player — it fetch()es track bytes and
Index: src/views/pages/post-edit.ejs
===================================================================
--- src/views/pages/post-edit.ejs	(revision 015ce465e5c0358e84f12cd2ca3297d32e390cee)
+++ src/views/pages/post-edit.ejs	(revision 9effb80995066fd31d07a2d3669248119426209d)
@@ -1102,4 +1102,5 @@
         cropper = new Cropper(img, { viewMode: 1, autoCropArea: 1, background: false, responsive: true });
       };
+      img.onerror = () => { cleanup(); resolve(file); }; // kon niet laden → upload het origineel
       img.src = url;