CSP missing default-src
The policy has no default-src fallback.
Why it matters
Directives you forget then have no restrictive default, so a new resource type can load from anywhere.
What to do
Add default-src 'self' or a tight host list, then override script-src and style-src as needed.
Reference
CSP Level 3 defines the directives and source lists this check evaluates.