The CSP Outage I Caused Myself: Placeholder Nonces, strict-dynamic, and Prebuilt Headers
A placeholder nonce that shipped to production took this site down for 41 minutes. Here is the exact failure, why static headers cannot emulate per-request nonces, and the three fixes that made the site both faster and actually secure.