the json example in the readme has no self in various params but the json file from the tests does have these set.
https://github.com/paragonie/csp-builder#example
https://github.com/paragonie/csp-builder/blob/e9a7560fd3f133a85f03c51de5fc051ac97630a7/test/vectors/basic-csp.json

for example i am guessing that using the example from the readme does not set self fore base-uri. but that might n

As hinted in aidantwoods/SecureHeaders#67 (comment), the public API could do with some better coverage.

• https://github.com/nico3333fr/CSP-useful/blob/master/csp-wtf/not-explained.md#blocked-uri-inline
• https://github.com/nico3333fr/CSP-useful/blob/master/csp-wtf/not-explained.md#onclick-attribute-on-menuitem-element

This happens if you don't allow inline scripts--that is, <script> with no src attribute, but rather embedded JavaScript. Inline JavaScript has to be explicitly allowed via `'in

I set the nuxt.config.js file with the following settings:

modules: [
    '@nuxtjs/axios',
    '@nuxtjs/pwa',
    [
      '@dansmaculotte/nuxt-security',
      {
        dev: false,
        csp: {
          directives: {
            defaultSrc: ["'self'"],
            scriptSrc: ["'self'"],
            connectSrc: ["'self'"],
            imgSrc: ["'self'"],
            sty

Question:
Which policies should I create?

Answer:
The default values for this plugin are a good start and in most cases you just need to define some additional policies. Just make sure not to weaken the policies by enabling unsafe-inline etc. Try finding the secure way to do these things.

1. Record what you use: https://addons.mozilla.org/en-US/firefox/addon/laboratory-by-mozilla/
   2

ie lets say the directive name + value is 'img-src https:'' and we collect some violations. Then we add an exemption so now it's 'img-src https: *.example.com' and we collect more violations.

Now the data is split across two records, we want it to be grouped by 'img-src' regardless of how the policy changes over time.

Tasks:

• first col should be the directive name, we will group record