fix(website): add unsafe-inline to CSP script-src for Astro inline scripts (#375)

ajitpratap0 · Ajit Pratap Singh · claude · web-flow · commit 8ba153f64307 · 2026-03-15T00:34:47.000+05:30
Astro generates inline &lt;script&gt; tags for component hydration, mobile
menu toggle, stats animation, and tab switching. The CSP was blocking
all of these, breaking interactivity on the live site.

Co-authored-by: Ajit Pratap Singh &lt;ajitpratapsingh@Ajits-Mac-mini-2655.local&gt;
Co-authored-by: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/website/src/layouts/BaseLayout.astro b/website/src/layouts/BaseLayout.astro
@@ -29,7 +29,7 @@ const canonicalURL = new URL(Astro.url.pathname, Astro.site);
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@500;700&family=Instrument+Sans:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap">
     <link rel="dns-prefetch" href="https://img.shields.io">
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-eval' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' https://img.shields.io https://goreportcard.com https://*.shields.io data:; connect-src 'self'">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' https://img.shields.io https://goreportcard.com https://*.shields.io data:; connect-src 'self'">
     <title>{title}</title>
   </head>
   <body class="min-h-screen flex flex-col">
