CSP the hard way: what three years of frontend security actually taught me

The theory vs. the first production rollout

The failure modes nobody warns you about

How I’d introduce CSP on a new project today

Takeaways for other frontend engineers

config can work in a page, break another one. many third part services don’t address csp and don’t support it (!). some teams are opened to talk about introducing support, like tldraw.