---
flags:
  script-src-elem:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
whitelist:
  connect-src:
    - "{{ lookup('config', 'web-app-bluesky', 'domains.canonical.api') }}"
    - https://plc.directory
    - https://bsky.social
    - https://api.bsky.app
    - https://events.bsky.app
    - https://public.api.bsky.app # nocheck: url  Reason: CSP origin, not a page; its root intermittently answers HTTP 404 to CI runners
    - https://*.workers.bsky.app # nocheck: url
    - https://statsigapi.net # nocheck: url
    - https://ip.bsky.app # nocheck: url
    - https://video.bsky.app
    - https://bsky.app
    - wss://bsky.network
    - wss://*.bsky.app
  media-src:
    - "blob:"
  worker-src:
    - "blob:"