strict-dynamic
A CSP directive that passes trust from a nonced script to the scripts it loads, removing the need for a domain allowlist.
Check whether your site applies it
VulScan Pro checks strict-dynamic automatically and shows the raw evidence.
Run a free audit