pub const CSP: &str = "default-src 'none'; script-src 'self'; style-src 'self'; \
img-src 'self' data:; connect-src 'self'; font-src 'self'; base-uri 'none'; \
form-action 'none'; frame-ancestors 'none'";Expand description
Content-Security-Policy of every UI response. Scripts and styles come only from the separate same-origin assets (no inline script or style), the page talks only to its own origin, and it cannot be framed.