bug: Content Security Policy (CSP)