Practical writing on script-src and Content-Security-Policy.https://script-src.com/https://script-src.com/blog/dev-server-breaks-script-src/https://script-src.com/blog/dev-server-breaks-script-src/Webpack wraps rebuilt modules in eval, Vite injects an inline preamble script, and HMR needs a websocket. What each dev server trips on under script-src, and the allowances to keep dev-only.Sat, 08 Aug 2026 00:00:00 GMThttps://script-src.com/blog/nonce-vs-hash/https://script-src.com/blog/nonce-vs-hash/A practical guide to allowlisting inline scripts under CSP script-src: nonces for dynamic pages, hashes for static ones, and the trade-offs of each.Wed, 01 Jul 2026 00:00:00 GMT