popovskikandClaude Opus 4.8
9877b4bbd6
Switch CSP from Report-Only to enforcing, with an allowlist verified in a browser against a server sending this exact header (0 violations across the homepage, a YouTube project page, the assistant, MailerLite JSONP, GA/gtag, and the Google Forms endpoint). Adds the sources the old report-only policy was missing (and would have broken if enforced blindly): Google Fonts (style/font), Font Awesome cdnjs (style/font), MailerLite newsletter (script/connect), the Google Forms endpoint in connect-src, plus object-src 'none'. Keeps 'unsafe-inline' for the in-<head> consent bootstrap; the host allowlists + form-action/base-uri are the real hardening on top of existing output escaping. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
msos spletna stran