Thanks to your post, I learnt about Content-Security-Policy in HTTP headers. I thought, that's awesome, let me add a tight CSP to my site (https://scripter.co) as I don't load any content from outside and the only thing going out are Webmentions sending requests... and then I realize that I use #mathjax on some pages..

MathJax requires me to add 'unsafe-inline' and 'unsafe-eval' to script-src, and 'unsafe-inline' style-src. So my overall CSP becomes quite weak :(

Anyone would have an idea how to implement CSP without those, and uses MathJax?

Thanks.