Developer disables Shiki syntax highlighting to preserve strict hash-based CSP

A web developer running a strict Content Security Policy (CSP) that allows scripts only by SHA-256 hash encountered a conflict when Astro's default syntax highlighter, Shiki, applied inline style attributes to code tokens. Because the site's policy blocks unsafe-inline styles and adding 'unsafe-hashes' would undermine the core security guarantee against injection attacks, the developer chose to disable syntax highlighting entirely. Code blocks now render using plain elements styled via external stylesheets and CSS classes, sacrificing per-token colour in favour of maintaining policy integrity. The developer noted that the real lesson was broader: any component that writes inline styles at render time — not just Shiki — is incompatible with a hash-based CSP, since the policy is compiled at build time. As a result, inline style shortcuts have been banned across the codebase, with the rule enforced at the point where the temptation most commonly arises.