and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
concert

Madrid Residency Night 6 — "Como Antes" Exclusive; 384,000+ Fans Through Six Sold-Out Nights

| Bad Bunny

Bad Bunny performs Night 6 of his 10-night Debí Tirar Más Fotos World Tour residency at Riyadh Air Metropolitano in Madrid before 64,000 fans — the closing show of Cluster 3 (June 6–7). The exclusive song for Night 6 is 'Como Antes,' the nostalgic DTMF ballad with Jorge Drexler and Carlos Sadness. Six of the ten sold-out nights are now complete; cumulative attendance across Nights 1–6 reaches approximately 384,000 fans. The residency's final two clusters remain: Cluster 4 (June 10–11) and Cluster 5 (June 14–15). The June 6–7 weekend saw Madrid simultaneously host Pope Leo XIV's first apostolic visit to Spain and Bad Bunny's residency third cluster — the Pope's viral quip about competition for Madrid audiences dominated international entertainment press through the weekend. The DtMF World Tour continues after Madrid: Düsseldorf (June 20–21), Arnhem (June 23–24), London's Tottenham Hotspur Stadium (June 27–28 — first-ever UK stadium dates), and Brussels (July 22). 'DtMF' remains at No. 1 on Billboard Hot Latin Songs for its 62nd consecutive week (chart dated June 6, 2026), continuing to extend the all-time chart record. Pixar's *Toy Story 5*, in which Bad Bunny voices 'Pizza with Sunglasses,' opens in theaters in 12 days (June 19, 2026).

Media

Bad Bunny's 10-night Madrid residency at Riyadh Air Metropolitano — Night 6 (June 7, 2026), exclusive: 'Como Antes'
Bad Bunny's 10-night Madrid residency at Riyadh Air Metropolitano — Night 6 (June 7, 2026), exclusive: 'Como Antes' — Billboard

Sources

View full Bad Bunny dashboard