None of 79 pages send a CSP; a strict policy would need 892 script hashes

A developer audited the security headers of a 79-page site and found no Content-Security-Policy on any page, aside from one that Next.js applies to its own image optimiser route. Testing a strict policy of script-src 'none' showed that only the executable inline script on a page would be blocked, while the schema.org JSON-LD data blocks remained intact and parseable. Most of the 1,357 inline scripts are framework code, namely theme setup and React Server Components payloads, and across the site they produce 892 distinct sha256 hashes. Because the payloads embed per-deploy asset identifiers, the hashes change with nearly every deployment, so the policy would need to be generated during the build and attached per route rather than as a single static header.