Mozilla Observatory grade

Trade-offs · 1

Recommended setting would break legitimate functionality. We accept the finding instead.

• content-security-policy

  OWASP requires CSP without `unsafe-inline` or any `eval` family directive. Two intentional deviations: (1) `unsafe-inline` — Next.js's React hydration requires inline `<script>` tags; eliminating it needs a per-request nonce-based CSP threaded through every render path (substantial refactor that also has to coexist with our 6 third-party scripts: Cloudflare Insights, Sentry, Auth0, Google Ads, Microsoft Clarity, Google Analytics). (2) `wasm-unsafe-eval` — required in production for client-side PDF export (@react-pdf/renderer compiles a WASM font/layout module via WebAssembly.instantiate). This is the narrow modern directive that permits WASM compile/instantiate ONLY — it does NOT permit JS eval(), new Function(), or string-form setTimeout. Removing it breaks PDF export with a CompileError. The broad `unsafe-eval` remains absent from the production CSP.