KrakenJS Helmet CSP script-src directive default value
KrakenJS includes the Helmet middleware to automatically apply a Content Security Policy header. By default, the injected CSP omits a script-src directive, which permits all scripts unless the developer adds one explicitly. The goal is to determine whether KrakenJS should supply a default script-src value that balances security with developer ergonomics. Con
krakenjs