CSP missing script-src
Scripts fall back to default-src because script-src and script-src-elem are absent.
Why it matters
An explicit script-src is easier to keep strict, especially when default-src is looser for images or connections.
What to do
Add script-src with nonces, hashes, or a short host allowlist.
Reference
CSP Level 3 defines the directives and source lists this check evaluates.