From Dev.to
Writing subtitle and audio tools by hand under a strict Content Security Policy
Our content security policy allows exactly two script sources: our own origin and Google's tag manager. That one line quietly ruled out every subtitle library we would normally reach for. No CDN, no n...