CSP for NeoMagic.css: Lock It Down Without Breaking Styles
NeoMagic.css is the kind of CSS framework people pick because they want speed, tiny bundles, and fewer moving parts. Good call. But once you start shipping a real app with analytics, fonts, icons, and maybe a little JavaScript sugar, your CSP usually turns into a weird mix of good intentions and emergency exceptions. I’ve seen this a lot: the app starts with a nice strict policy, then somebody adds a tag manager, then a consent banner, then inline styles sneak in, and now style-src 'unsafe-inline' is hanging around forever like a bad temporary fix. ...