Content-Security-Policy reduces XSS blast radius but conflicts with inline scripts unless you nonce or hash them. Vite’s manifest helps reference built assets without unsafe directives.
Document nonce middleware and the exact directives you allow for rich text editors on admin pages; third-party scripts need explicit hosts in script-src and connect-src.
Run an automated CSP checker against staging after each deploy so regressions are caught before production.