fix(security): swap script-src 'unsafe-inline' for a per-request CSP nonce - #11220

Merged

MarkusNeusinger merged 8 commits into

mainfrom

infra/csp-nonce

Sep 4, 2026

Commits on Sep 4, 2026

fix(security): swap script-src 'unsafe-inline' for a per-request nonce

MarkusNeusinger
and
claude
committed
3e058af
fix(security): address the Copilot review of the nonce path

MarkusNeusinger
and
claude
committed
74f48e4
test(csp): the shell-route count and its message agree

MarkusNeusinger
and
claude
committed
71c6359
fix(security): the nonce smoke has to ask for compression

MarkusNeusinger
and
claude
committed
39e8a29
docs(csp): the preload nonce is a real mechanism, and 128 bits is a floor

MarkusNeusinger
and
claude
committed
256b282
test(csp): match the shell exclusion, do not search for the word

MarkusNeusinger
and
claude
committed
7aab6d6
test(csp): run the exclude pattern, and demand 32 hex digits

MarkusNeusinger
and
claude
committed
4569fd9
test(csp): the server-level guard has to look at server level

MarkusNeusinger
and
claude
committed
6471eea