Security policy allows scripts directly in the HTML

A Content Security Policy decides which code may run in the browser. With 'unsafe-inline', any code written directly into the HTML may run as well — and that is exactly where injected code lands in most attacks via forms, comments or listing texts.

We only report this when the policy otherwise works: it names allowed sources, and nonce, hash and 'strict-dynamic' are missing — with those, browsers ignore 'unsafe-inline' anyway. A policy that limits nothing is already listed under “Content Security Policy without effect”.