#security headers

Don't block first: use CSP Report-Only to find real dependencies, then tighten safely

CSP Report-Only is not a pause in security. It reveals real dependencies, noise, and legacy code patterns before a nonce-, hash-, and least-privilege policy reaches production.