security(csp): migrate script-src from 'unsafe-inline' to per-request nonce#401

Merged

BigSimmo merged 3 commits into

mainfrom

claude/csp-nonce-migration

Jul 8, 2026

Commits on Jul 8, 2026

security(csp): migrate script-src from 'unsafe-inline' to per-request nonce

BigSimmo
and
claude
committed
test(csp): cover the production nonce path in the proxy

BigSimmo
and
claude
committed
refactor(csp): derive runtime flags from one shared helper

BigSimmo
and
claude
committed