# Merge these allowed sources into your existing CSP; do not replace it blindly.
script-src 'self' {{ORIGIN}};
connect-src 'self' {{ORIGIN}};
img-src 'self' {{ORIGIN}};
media-src 'self' {{ORIGIN}};
frame-src 'self' {{ORIGIN}};
# Built-in renderer uses inline element styles; adapt style-src to your policy.
