"Well, CSP is variable, so at least removing all inline JS and not using eval would already make it a lot better (also when considering pe..."