SEC-CSP-002
security WARNING CSP with unsafe-inline/unsafe-eval
Description
The CSP allows `unsafe-inline` or `unsafe-eval` for scripts, weakening XSS protection.
Recommendation
Replace them with script nonces or hashes.
- Introduced in ruleset : 2026.09.0
- Detector :
csp_unsafe
Risks detected according to the technical rules currently configured. Publication remains subject to Apple's and Google's review, and their rules evolve.