content-security-policy - 'unsafe-inline' in script-src neutralises most XSS protections CSP provides

'unsafe-inline' in script-src neutralises most XSS protections CSP provides. Remove it and use nonces or hashes instead.

content-security-policy - 'unsafe-eval' in script-src allows dynamic code execution via eval()

'unsafe-eval' in script-src allows dynamic code execution via eval(). Remove it to close a significant injection surface.