forgia · dev log

Engineering log for the forgia LMS platform.

• 23 Jul 26
  A Content-Security-Policy, and Three Things It Caught Before Shipping

  A CSP header allowlisting our own scripts plus Paddle and Bunny, shipped report-only first — which is exactly what caught a frame-src fallback misunderstanding, a Paddle CDN subdomain, and Course thumbnails actually living on Backblaze B2, not local disk.

  securityphoenixplugpaddlebunny