mandaloreandClaude Sonnet 5
812e81e220
style-src 'self' (without unsafe-inline) silently blocks style="..." attributes introduced via innerHTML — the CSS parses fine and the attribute is present in the DOM, but the browser never applies it, so every bar rendered at its track's full width regardless of its real percentage. script-src stays locked down; this only loosens CSS, and no untrusted external content is ever rendered into a style attribute here. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>