HTML · Security · Junior · Architecture
Explain Content-Security-Policy at a high level for HTML apps.
Short Interview Answer
HTTP header (or meta) whitelisting sources for scripts, styles, images, etc.
Detailed Explanation
script-src matters most for XSS. Nonces/hashes beat unsafe-inline. Report-Only for rollout.