https://csp-guide.com/tags/script-src/ Recent content in Script-Src on CSP Guide Hugo -- gohugo.io en-us Sat, 08 Aug 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-unleash-feature-flags/ Sat, 08 Aug 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-unleash-feature-flags/ <p>Feature flags look harmless until CSP starts blocking them in production.</p> <p>Unleash is a good example. The SDK itself is usually straightforward, but the moment you load a frontend client, bootstrap flags, poll an API, or stream updates over SSE or WebSockets, your CSP needs to be precise. Most breakages come from people treating Unleash like “just another script” when the real problem is usually <code>connect-src</code>.</p> <p>I’ve seen teams waste hours tweaking <code>script-src</code> while the browser was yelling about a blocked fetch the whole time.</p>