CSP for Mermaid Diagrams: A Before-and-After Case Study
I’ve seen this exact failure pattern a few times: a team adds Mermaid to docs or an internal dashboard, the diagrams look great locally, then production CSP quietly wrecks everything. The symptoms are boring but expensive: diagrams don’t render initialization throws console errors someone “fixes” it by adding 'unsafe-inline' or weakening script-src now the page works, but the policy got worse Mermaid is a perfect example of where frontend convenience collides with a real CSP. If you run a site with a strict policy, you can’t just paste the snippet from a README and hope for the best. ...