[zupa-hu]

TLDR: CSP can by bypassed if you don't use it on all responses, like error pages.

This is of course not bypassing CSP.