Const
Strict Content-Security-Policy injected into every staged HTML file (Decision 3).
Blocks all external network egress (connect-src 'none', frame-src 'none', worker-src 'none', object-src 'none', base-uri 'none', form-action 'none') while allowing local bundle files ('self'), data: / blob: URIs, and inline composition scripts/styles.
connect-src 'none'
frame-src 'none'
worker-src 'none'
object-src 'none'
base-uri 'none'
form-action 'none'
'self'
data:
blob:
Strict Content-Security-Policy injected into every staged HTML file (Decision 3).
Blocks all external network egress (
connect-src 'none',frame-src 'none',worker-src 'none',object-src 'none',base-uri 'none',form-action 'none') while allowing local bundle files ('self'),data:/blob:URIs, and inline composition scripts/styles.