Comment by theandrewbailey

I have a strict CSP with report-URI on my blog, but all the reports I get are from obscure browser extensions injecting CSS and JS into my pages.