@crunklord420 @mint @lain @graf You're misunderstanding the problem. The issue is that the mime detection is too good. We get back application/javascript instead of text/plain for uploaded JS files, leading to injection possibility without needing to bypass CSP in any way.