- Shipped
- 20 Agosti 2026, 05:10 UTC
- Author
- Kamo
- Commit
- 3d44d3f
Clears the "No Content-Security-Policy header with Trusted Types directive found" finding by moving require-trusted-types-for into the enforced policy. This is evidence-backed rather than a second guess. It shipped report-only first and the console came back with ZERO Trusted Types violations, which is exactly the proof needed: report-only logs a violation for every sink reached without a policy, so no violations means the default policy was installed ahead of all of them. What made that true was dropping next/script for a plain inline <script> in <head>. check-trusted-types-order.mjs holds the placement. Also narrows script-src from hosts to paths, which is the "host allowlists can frequently be bypassed" finding taken literally. On theme.kamocrm.com that was not hypothetical: it is the org theme bucket, white-label tenants upload their own assets into it, and `script-src https://theme.kamocrm.com` therefore let any tenant drop a .js file in their own bucket and have this site execute it. Only /public/widget/ is executable now — the loader and its hashed bundle both live there — and analytics is pinned to the exact tracker file.