mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-11 21:26:44 +00:00
unsafe-inline re-admits the inline execution an XSS needs and unsafe-eval re-admits string-to-code, so a CSP relaxation must be verified against the running app rather than copied from another role. The new lint requires a nocheck marker plus a Reason on the flag's own line, so a marker cannot drift to the neighbouring directive. The 197 pre-existing grants across 70 roles are checked out with a TODO: they were never verified and still have to be. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Actions 🚀
This directory contains contributor workflow guidance. Its scope is branch strategy, commits, testing, local deploys, CI, review, pull requests, releases, and the end-to-end path from local change to merged contribution.