From 6013d0bcab2c3bda5d9e2508205b7b0be9e301e2 Mon Sep 17 00:00:00 2001
From: Johannes Erwerle <jo@swagspace.org>
Date: Wed, 21 Oct 2026 22:11:16 +0200
Subject: [PATCH] added comment regarding CSP

Closes #11
---
 README.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/README.md b/README.md
index 4330a0f..b340c76 100644
--- a/README.md
+++ b/README.md
@@ -177,3 +177,13 @@ BORG_SERVER_PUBKEYS = [
     ),
 ]
 ```
+
+## Webserver Config / Content-Security-Policy
+
+This page by itself does not load external sources and does not use inline javascript/styling.
+It only loads javascript, CSS and images.
+Therefore the following Content-Security-Policy should work fine in the standard cases:
+
+```
+Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self';"
+```