and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
concert

Madrid Cluster 4 Complete — Mora Joins Night 8; 512,000+ Fans Through Eight Nights

| Bad Bunny

Bad Bunny completes Cluster 4 (Nights 7–8, June 10–11) of his 10-night Debí Tirar Más Fotos World Tour residency at Riyadh Air Metropolitano in Madrid. Night 7 (June 10) featured no musical guest — 'Un Verano Sin Ti' was the exclusive song — with footballers Alexia Putellas and Kika Nazareth among the 64,000 in attendance. Night 8 (June 11) brought out Puerto Rican artist Mora to perform their 2023 collaboration alongside a run of his own biggest tracks. Eight of ten sold-out nights are now complete, with cumulative attendance reaching approximately 512,000 fans. One cluster remains: Cluster 5 (June 14–15), the residency's closing nights.

Media

Bad Bunny's Madrid residency — Cluster 4 (June 10–11, 2026): Mora joins Night 8
Bad Bunny's Madrid residency — Cluster 4 (June 10–11, 2026): Mora joins Night 8 — Billboard

Sources

View full Bad Bunny dashboard