Hacker News Reader

JSONP only allows CSP bypass if you return anything other than JSON objects from an API. As long as you don't do that, CSP is fine.

Since JSONP allows you to have a callback, you can load this in script tags on the same domain and make calls to that / those functions.