CSP for GitHub Buttons: Safe Embeds Without Guesswork
GitHub buttons look harmless. They’re tiny. They show a star count. They make product people happy. They also pull in third-party resources, which means they touch your Content Security Policy. If your CSP is strict — and it should be — GitHub buttons are one of those “why is this blocked?” annoyances that show up late in a launch checklist. Here’s how I handle them without turning CSP into mush. ...