and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
milestone

Puerto Rico Senate Hears Water, Power, and Tourism Agencies Oppose Esencia Megaproject Bad Bunny Targeted Onstage

| Bad Bunny

The Puerto Rico Senate's Commission on Innovation, Reform and Appointments, chaired by Senate President Thomas Rivera Schatz, held a public hearing under Senate Resolutions 9 and 459 investigating the feasibility of the roughly $2 billion Proyecto Esencia tourism-residential megaproject in Cabo Rojo's Los Pozos sector — the same project Bad Bunny demanded be "canceled" from the Hiram Bithorn stage on his Aug. 22–23 tour-closing nights, and that thousands marched against in Cabo Rojo on Aug. 23 following his on-screen call to action. Three government agencies testified against the project as proposed: the Aqueduct and Sewer Authority (AAA) said existing infrastructure cannot supply the project's roughly 1.25 million gallons of daily groundwater demand; the Electric Power Authority (AEE) said the regional system already operates at capacity and recommended alternatives like seawater desalination; and the Puerto Rico Tourism Company (CTPR) said the project is predominantly residential rather than tourism-focused and recommended scaling back its residential footprint. Senator Eliezer Molina said it was the first time in his career he had seen the Office of Permit Management (OGPe) grant permits over the unanimous opposition of government agencies. The Senate president said he would not allow flawed permitting processes to proceed without proper legal review. Under direct questioning from Senate President Rivera Schatz, PRASA engineer Ann Ventura confirmed the system "does not have the capacity" to serve the project, and said the Lajas Valley irrigation system lacks available hydric capacity for new demands; PREPA separately warned that additional well pumping could degrade the water resource. Environmental advocates testified to a risk of catastrophic saltwater intrusion near the Peñones de Melones ecosystem, and it emerged that Esencia's eligibility for $497 million in tax credits depends on meeting investment requirements. The Senate scheduled a second hearing for the following Tuesday, with testimony expected from the Office of Permit Management (OGPe), the Department of Natural and Environmental Resources, and the project's developers.

Proyecto Esencia's proposed Cabo Rojo site, subject of an Aug. 27, 2026 Puerto Rico Senate hearing
Proyecto Esencia's proposed Cabo Rojo site, subject of an Aug. 27, 2026 Puerto Rico Senate hearing — El Nuevo Día