Thanks @mjangda, we’ve moved the whitelist check to before creating the script element.