@hypolite So if I send:Content-Security-Policy: script-src: 'none'<html><script>alert("OH NO");</script></html>With a valid Content-Length and junkWould that work?