Taking tameen.it from an F to an A+ on security headers โ CloudFront policy, a pragmatic CSP, and why strict CSP wasn't worth it.
Real content lands in the publish task.