security: inject strict CSP into HTMLFrame blob document#297

Open

pjdoland wants to merge 2 commits into

pjdoland:fix/htmlframe-csp

Commits on May 18, 2026

fix(chat): inject strict CSP into HTMLFrame blob document
pjdoland
committed
review: keep leading DOCTYPE first so iframe stays in standards mode
pjdoland
committed