Why it matters
Most cross-site scripting attacks inject an inline script. A policy that allows inline scripts lets them run. Nonces or hashes give you the same convenience without the hole.
How Patch checks
We read the script-src (or default-src) directive of your Content-Security-Policy and look for 'unsafe-inline' without a nonce or hash, and for 'unsafe-eval'.
How to fix it
- Move inline scripts into files, or give them a nonce or hash.
- Remove the unsafe sources from script-src.
- Test with the policy in report-only mode first.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.