Juan Denis 81aa19dafd fix(security): drop unsafe-inline/unsafe-eval from script-src ...

Move the theme FOUC snippet to /theme-init.js, allow the build-injected
vendor importmap by sha256, keep blob: for runtime extensions. Document the
localStorage token limitation in SECURITY.md.

2026-11-03 12:57:58 -05:00

..

sites-available

fix(security): drop unsafe-inline/unsafe-eval from script-src

2026-11-03 12:57:58 -05:00

nginx.conf

fix(security): drop unsafe-inline/unsafe-eval from script-src

2026-11-03 12:57:58 -05:00