and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
milestone

Thousands March in Cabo Rojo Against Esencia Megaproject, Answering Bad Bunny's On-Screen Call

| Bad Bunny

Hours after Bad Bunny's Aug. 22 closing-night message flashed "ESENCIA NO VA. MAÑANA 2:00 PM. MARCHA CABO ROJO" across the Hiram Bithorn stadium screens — triggering a stadium-wide chant of "¡Esencia no va!" — the Coalición Defiende a Cabo Rojo (DaCR) led a national march and public hearing dubbed "Cabo Rojo es nuestro – Marcha a la vista" on Aug. 23. Hundreds of demonstrators, including planners, scientists, and educators, gathered at the intersection of Highways 100 and 308, marching with Puerto Rican flags and arriving by bicycle and tractor, stopping periodically along the route to discuss the roughly $2 billion Proyecto Esencia luxury resort's threats to housing access, ecological reserves, and the region's water supply, before concluding at the Dr. Ramón Emeterio Betances public plaza. Opposition organizers argued the project's siting was approved "a espaldas del pueblo y sin vistas públicas" (behind the public's back, without public hearings) and would benefit only a handful of investors. It was DaCR's second major mobilization against Esencia after a March 28, 2026 march in Old San Juan, but the first amplified directly from Bad Bunny's own stage.

Demonstrators gather for the "Cabo Rojo es nuestro" march against Proyecto Esencia, Aug. 23, 2026
Demonstrators gather for the "Cabo Rojo es nuestro" march against Proyecto Esencia, Aug. 23, 2026 — Primera Hora