The Content Security Policy on this site allows scripts by SHA-256 hash. Not unsafe-inline, not a nonce, not a wildcard. A list of exact digests, and anything whose bytes don't match one of them does not run.
That is the strong version of the policy, and it is strong for a boring reason: a hash is a statement about content that nobody can forge. If an injection lands in my HTML, it does not matter that it sits in a <script> tag on my own origin. Its hash isn't on the list, so it's inert.
The cost of that arrived the first time I put a fenced code block in an article.
What a hash can and cannot cover
Astro computes these hashes during the build and writes them into a <meta http-equiv>. It knows the bytes of every script it bundles, so it can digest them and emit a policy that matches.
