pub const CSP: &str = "default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; \
style-src 'self'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; \
form-action 'none'";Expand description
Content-Security-Policy for the v2 page.
The bundle is fully self-contained — no CDN, font, remote image, or inline
handler — so every fetch directive is denied except same-origin.
'wasm-unsafe-eval' is the one grant WebAssembly instantiation requires;
without it the module refuses to start.