Story: the Content Security Policy #

This page is for technology and security journalists. A Content Security Policy is a browser rule that limits which scripts and styles a page may run. In October 2026 Exponential's administration was rebuilt so that a strict policy can be switched on. This page explains what that means and how to describe it accurately.

Contents #

1. The story in one paragraph
2. What is new, and when
3. Facts you can print
4. What not to claim
5. Explaining it to readers
6. Angles and headline ideas
7. Who to ask
8. Related pages

The story in one paragraph #

"A strict policy (script-src 'self', no 'unsafe-inline') means that a script injected into a page through a stored or reflected value does not run, even where a template forgets to escape it" (Content Security Policy). To make such a policy possible, the administration designs admin4 and admin4l were changed to carry "no inline <script>, no on...= attribute, no javascript: link, no style="" attribute and no <style> element" (6.0.15 changelog). The policy ships in report-only mode on the administration and off on public sites; the administrator decides when to enforce it, and rolling back is one setting.

What is new, and when #

All in the 6.0.15 line, the current release line of Exponential 6.0; the dates are dates of the changes, not a release date.

Facts you can print #

What not to claim #

• "Exponential blocks cross-site scripting." By default the administration only reports; enforcement is the administrator's decision, and public sites have no policy unless one is set.
• "Every extension is ready for an enforced policy." The changelog keeps a shrinking allowlist of extensions that still have inline code.
• "The CSP protects you" without the mode. Always say report-only or enforced.

Explaining it to readers #

A Content Security Policy is a list the website sends to the browser: "only run scripts that come from my own
server". If an attacker manages to slip a script into a page, the browser refuses to run it. Exponential's
administration was rewritten so that this list can be strict. It starts in "report" mode, where the browser
only tells the site what it would have blocked.

Angles and headline ideas #

"Rewriting an administration so the browser can say no"
"Report first, enforce later: how Exponential rolls out a strict browser policy"
"No inline scripts: the quiet security rule behind Exponential's new admin"

Who to ask #

Related pages #

• Story: security
• Content Security Policy (feature page)
• Talking points: security
• Feature stories: index
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.