Change:
"title": "Set a Content Security Policy with helmet.contentSecurityPolicy()", "description": [ "As a reminder, this project is being built upon the following starter project on <a href='https://glitch.com/#!/import/github/freeCodeCamp/boilerplate-infosec/'>Glitch</a>, or cloned from <a href='https://github.com/freeCodeCamp/boilerplate-infosec/'>GitHub</a>.", <del> "This challenge highlights one promising new defense that can significantly reduce the risk and impact of many type of attacks in modern browsers. By setting and configuring a Content Security Policy you can prevent the injection of anything unintended into your page. This will protect your app from XSS vulnerabilities, undesired tracking, malicious frames, and much more. CSP works by defining a whitelist of content sources which are trusted. You can configure them for each kind of resource a web page may need (scripts, stylesheets, fonts, frames, media, and so on…). There are multiple directives available, so a website owner can have a granular control. See HTML 5 Rocks, KeyCDN for more details. Unfortunately CSP in unsupported by older browser.", </del> <ins> "This challenge highlights one promising new defense that can significantly reduce the risk and impact of many type of attacks in modern browsers. By setting and configuring a Content Security Policy you can prevent the injection of anything unintended into your page. This will protect your app from XSS vulnerabilities, undesired tracking, malicious frames, and much more. CSP works by defining a whitelist of content sources which are trusted. You can configure them for each kind of resource a web page may need (scripts, stylesheets, fonts, frames, media, and so on…). There are multiple directives available, so a website owner can have a granular control. See HTML 5 Rocks, KeyCDN for more details. Unfortunately CSP is unsupported by older browser.", </ins> "By default, directives are wide open, so it’s important to set the defaultSrc directive as a fallback. Helmet supports both defaultSrc and default-src naming styles. The fallback applies for most of the unspecified directives. In this exercise, use helmet.contentSecurityPolicy(), and configure it setting the defaultSrc directive to ["self"] (the list of allowed sources must be in an array), in order to trust only your website address by default. Set also the scriptSrc directive so that you will allow scripts to be downloaded from your website, and from the domain 'trusted-cdn.com'.", "Hint: in the "'self'" keyword, the single quotes are part of the keyword itself, so it needs to be enclosed in double quotes to be working." ],

Discussion:
Typo in the description. !
Just to make it clear, you are suggesting to change to . Is there any other typos that you found in this challenge?
Correct. That's the only typo I have found. I know it's minor issue but it will be a good opportunity to fix for beginners.
this is the file with the typo -
I am a little confused about challenge files. What about this file in repo? Where should one correct the mistakes?
im confused at the moment as well - there's some changes in progress regarding where the challenges are so I'm not sure if we should be making PR's involving seed files to the main repo or the curriculum repo - I would guess it will be over there in future but at the moment I'm not sure what's best
For now I am solving all typos in curriculum, so if anyone finds any typo in the challenges please refer me.