and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
← Dashboard

About Ukraine History Tracker

What is this?

Intelligence dashboard covering the full history of Ukraine from the founding of Kyivan Rus (882 CE) through Soviet rule, independence, and the ongoing Russian war of aggression. Data is updated nightly via AI-assisted analysis of open sources. Every data point is tagged with a source tier (from official/primary to unverified) so readers can assess reliability at a glance.

Disclaimer & No Guarantees

This dashboard is provided on a best-effort basis, with no warranties of any kind—express or implied.

  • Information may be incomplete, delayed, or inaccurate.
  • AI-assisted updates may introduce errors. All AI outputs are validated against schemas, but factual accuracy cannot be guaranteed.
  • This project does not endorse any political position, government narrative, or military action.
  • Nothing here constitutes professional intelligence analysis, legal advice, or journalistic reporting.
  • The dashboard presents multiple perspectives without claiming any single perspective is correct.

Built With

AstroStatic site framework
ReactInteractive island components
CesiumJS3D globe visualization
Leaflet2D interactive mapping
ZodSchema validation
TypeScriptType-safe codebase
Claude APIAI-assisted data updates

Open Source

This project is open source. View on GitHub—contributions, bug reports, and feature suggestions are welcome.