https://shipreadyai.dev/learn/findings/o2-csp-unsafe-inline

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# The content policy allows inline scripts

The script-src rule includes unsafe-inline, which removes most of the protection the policy would otherwise give.

## Why AI-built apps get this

Response headers are written by nobody. Your framework does not add them, your builder does not add them, and your host adds one or two at most. They are the clearest example of a gap that no tool closes on your behalf, which is why almost every app built by a prompt ships without them.

## Evidence line

GET https://example.com returned no strict-transport-security header

## The fix

Remove unsafe-inline from script-src and move inline scripts into files, or use a nonce or hash. Observed: {value}.

## Prompt

Your policy allows unsafe-inline for scripts ({value}). Use a nonce or hash for inline scripts instead, and move the rest into files, so the policy actually restricts what can run.