CSP Builder

Four rounds. For each one, write a script-src directive that lets every legitimate script run and blocks every malicious one. Tokens you can use: 'self', 'none', 'unsafe-inline', 'unsafe-eval', a full origin like https://cdn.example.com, and 'nonce-XYZ'.