csp.yml

---
flags:
  style-src-attr:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
  style-src-elem:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
  script-src:
    unsafe-eval: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
  script-src-elem:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
  script-src-attr:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
whitelist:
  script-src-elem:
    - https://www.googletagmanager.com # nocheck: url — script CDN, bare domain returns 404 by design
  script-src:
    - https://www.googletagmanager.com # nocheck: url