[robocat]

MDN docs for Content Security Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP (for anyone unfamiliar with that browser feature that should in theory disallow injection for websites you control).