Function default_csp 

pub fn default_csp() -> String

default-src 'self' and nothing external.

'unsafe-eval', and why it is not optional here

PulsePoint compiles the expressions in a reactive block at runtime: it parses them and builds a render function with new Function, which the CSP counts as evaluating a string as JavaScript. That is what makes it a browser runtime rather than a build step, and it is not something a configuration option turns off.

Without the directive the page still renders — the document is server-rendered — and every binding on it is dead, reporting EvalError: … violates the following Content Security Policy directive from inside the minified bundle. Which is a failure worth naming, because the sentence “tighten the CSP” is otherwise an obvious-looking change that breaks the whole browser layer of the application in a way that reads as a PulsePoint bug.

It is narrower than it sounds: script-src still refuses every source but this origin, so injected markup cannot load an attacker’s file. What it permits is the application’s own runtime compiling the application’s own expressions.

The rest: connect-src covers pp.rpc, the streaming responses and the WebSocket — ws: because the socket is on the loopback origin, which is not TLS. img-src data: is what an inline SVG data URI needs; style-src 'unsafe-inline' is what a style attribute needs, which PulsePoint writes when a binding targets one.