Good Afternoon,
I am reaching out to request assistance with enhancing the security of my Shopify store by implementing specific Content Security Policy (CSP) directives. I recently purchased a theme from the Shopify themes list and noticed a significant improvement in my store's performance as indicated by Page Speed Insights. However, I have encountered two security issues related to CSP that I need help addressing:
Missing script-src directive:
The absence of this directive can allow the execution of unsafe scripts, potentially exposing my store to XSS attacks. Missing object-src directive:
The absence of this directive permits the injection of plugins that may execute unsafe scripts. I would like to set object-src to 'none' to prevent this. Despite my efforts to manually add these directives to the theme.liquid file, I have not been successful. Could you please assist me with correctly implementing the following CSP directives in my theme.
