Security headers should describe the actual page
Start with a narrow policy, then expand it only when a documented feature needs another resource.
Web-Security
Start with a narrow policy, then expand it only when a documented feature needs another resource.