Use a content security policy around wallet-facing code

A content security policy can limit which resources a swap interface loads and where it connects. It complements secure application code, but it cannot determine whether a user-reviewed transaction is economically correct.

MDN's CSP guide describes resource directives, script restrictions and report-only deployment. Start from the resources the application actually needs rather than pasting a broad policy from an unrelated site.

Map the browser surface

Inventory application scripts, worker code, RPC or backend connections, token images and embedded widget origins. Give each an explicit purpose. A wallet-facing page should not load an unrelated third-party script simply because another section of the site uses it.

Pay particular attention to script execution and connection destinations. A restrictive image policy does not compensate for allowing arbitrary scripts. Avoid broad exceptions introduced solely to silence an unexplained violation.

Stage the rollout

Use report-only mode to observe legitimate flows, then investigate violations before enforcement. Exercise connection, quote refresh, wallet review, transaction tracking and any embedded widget paths. A policy that works on the landing page may still break a later worker or network request.

Keep violation reporting itself within the privacy policy. Reports can contain URLs and context, so apply appropriate access and retention controls.

Maintain the other boundaries

Continue validating token metadata and rendering it as text. CSP is not permission to insert untrusted HTML. Likewise, origin restrictions do not establish that every response from an allowed provider is suitable for execution.

Review policy changes alongside dependency and widget updates. If a new SDK asks for a broader source allowance, understand the reason and the resulting trust boundary before accepting it.

A useful rollout record lists the tested user flows, intentional external origins and unresolved violations. It should describe observed behavior, not claim that a policy proves the interface secure.