Whenever we add a strict Content-Security-Policy header to an older web app, starting with
Content-Security-Policy-Report-Only for the first 48 hours saves so many headaches. You always discover at least one forgotten inline script or third-party font domain that would have broken in production.commit b6b9ab9