A browser boundary labeled enforcing CSP and script-src 'none' contains available HTML, CSS and SVG assets beside a blocked script lane. Content, publishing, generator and server responsibilities remain outside it.

The zero-JavaScript static site is a defensible choice

An explicit script-src ’none’ policy is a boundary with a measurable contract.

August 13, 2026 · 4 min · XB Field Notes