and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
milestone

Second Milan Show Cancelled After Violent Hailstorm Forces 80,000-Person Evacuation

| Bad Bunny

Bad Bunny's second Milan concert at Ippodromo SNAI La Maura is cut short shortly after the set began when a violent hailstorm — with hailstones described as "the size of walnuts" — hits the 80,000-capacity outdoor venue. Organizers initially asked the crowd to shelter in place before ordering a full evacuation as conditions worsened; several attendees were struck on the head by hailstones and treated by Italy's 118 emergency medical service, with the nearby Uruguay metro station closed early to manage crowd flow. Live Nation confirmed the show would not be rescheduled and offered full refunds (ticket price plus booking fee) to all ticket holders, ending the tour's Italian leg.

Media

Fans evacuate Ippodromo SNAI La Maura in Milan as a hailstorm forces the cancellation of Bad Bunny's second Milan show, July 18, 2026
Fans evacuate Ippodromo SNAI La Maura in Milan as a hailstorm forces the cancellation of Bad Bunny's second Milan show, July 18, 2026 — The Daily Beast / Reuters

Sources

View full Bad Bunny dashboard