KrakenJS Helmet CSP script-src directive default value

KrakenJS includes the Helmet middleware to automatically apply a Content Security Policy header. By default, the injected CSP omits a script-src directive, which permits all scripts unless the developer adds one explicitly. The goal is to determine whether KrakenJS should supply a default script-src value that balances security with developer ergonomics.

Constraints include avoiding breakage of legitimate inline scripts or third‑party widgets, accounting for browsers that do not support the strict-dynamic keyword, and limiting CSP violation report noise. The unresolved decision is whether to bake in a default such as 'self' strict-dynamic (with a fallback nonce or hash) or to leave the directive optional and rely on explicit configuration.

Should KrakenJS enable a default script-src that includes 'self' and strict-dynamic? How should the framework handle browsers lacking strict-dynamic support? What fallback mechanism, if any, should be provided to maintain security without generating excessive violation reports?