CSP with nonce in 2026 — no unsafe-inline on script

Minimum

· script-src 'nonce-…' 'strict-dynamic'

· No 'unsafe-eval' in production

· Report-Only first, then enforce

Cyberside sends CSP with a per-request nonce.