Ideally, we should have `default-src 'none'` and then enable the things we need (like `frame-src *` as per your comment).