[Info] CSP header allows unsafe-inline and unsafe-eval for scripts

[hhhashexe]

Description

Content-Security-Policy includes:

script-src 'self' 'unsafe-inline' 'unsafe-eval'

This weakens XSS protection since inline scripts and eval() are allowed.

Context

Common for Next.js apps. Low priority but worth noting for security posture.

Reference

https://nextjs.org/docs/app/building-your-application/configuring/content-security-policy

Severity

ℹ️ Info — noting for future improvement