and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
milestone

Judge Denies Bad Bunny $465K in Legal Fees After Winning Dismissed Sampling Suit

| Bad Bunny

U.S. District Judge Otis D. Wright II denied Bad Bunny's bid to recover $465,612 in legal fees from Nigerian producer Dera (Ezeani Chidera Godfrey) and his label emPawa Africa, even though their copyright suit over 'Enséñame a Bailar' (Un Verano Sin Ti, 2022) had already been dismissed. Dera alleged the track sampled his 2019 production for Joeboy, "Empty My Pocket," without clearance; Bad Bunny's team maintained the sample was cleared through producer Lakizo, though Dera disputed Lakizo's authority to grant it. The case was effectively abandoned after Dera's attorneys withdrew in January 2026 citing strategy disputes, he missed a February discovery hearing, and then missed a March 6 filing deadline, leading Judge Wright to dismiss the suit on March 9. Ruling on the fee request, Wright found emPawa's original claims "objectively reasonable" and said awarding fees to Bad Bunny would "send the wrong message" to copyright holders — leaving Bad Bunny on the hook for his own legal costs despite the win.

Media

Bad Bunny's 'Un Verano Sin Ti' copyright fee dispute with emPawa Africa
Bad Bunny's 'Un Verano Sin Ti' copyright fee dispute with emPawa Africa — Complex

Sources

View full Bad Bunny dashboard