---
whitelist:
  script-src-elem:
    - https://cdn.matomo.cloud # nocheck: url
  style-src-elem:
    - https://fonts.googleapis.com # nocheck: external-cdn,url  TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
flags:
  script-src-attr:
    unsafe-eval: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
    unsafe-inline: true # nocheck: csp-unsafe  Reason: Matomo core renders the top-bar "What's new" entry with an inline onclick (plugins/CoreAdminHome/Menu.php); logout-enabled deploys already grant it through the logout injector
  script-src-elem:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
    unsafe-eval: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
  style-src-attr:
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
    unsafe-eval: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface