Content Security Policy

So...

Report Your Eye has customers that are reporting on things like CSP violations.

So if someone comes to their website and there is a request from the person's client to an external script source, for example, if that is not allow listed within the CSP, there's a report that gets sent to Report Your Eye.

And the primary reason for doing this is that if someone manages to find cross-site scripting or some other downstream dependency and starts injecting nasty things into your website, you report it.

It's really good going by a Report Your Eye subscription.

The other thing that can cause the CSP violations is if there are things like malicious browser extensions,

or not even necessarily malicious

ones, but just browser extensions in general on someone's browser who is visiting the website with the CSP, trying to pull in resources from another location, and that can cause violations.

But while we were at it, we managed to also add CSP mode.

So now Datastar can run without enabling unsafe eval when using a content security policy.

And the best part is we managed to do this without putting it in Pro, without putting it in an extra plugin.

It's just baked into Datastar.