The build section should talk about contrib. The contributing section should cover:

1. Differences between npm version and github version.
2. Process for building (or should that be in build) and running tests.
3. Contribution guidelines.

the json example in the readme has no self in various params but the json file from the tests does have these set.
https://github.com/paragonie/csp-builder#example
https://github.com/paragonie/csp-builder/blob/e9a7560fd3f133a85f03c51de5fc051ac97630a7/test/vectors/basic-csp.json

for example i am guessing that using the example from the readme does not set self fore base-uri. but that might n

Expected behavior

limit the first search strategy to 1 second in solve THEN use the second strategy (to improve the best so far solution)

Actual behavior

search.limit Monitor are attach to search and not strategy.

Minimal Working Example

Experienced with choco-solver-4.0.4

solv.setSearch(
new AbstractStrategy[] {
Search.intVarSearch(new MaxRegret(), new IntDoma

As hinted in aidantwoods/SecureHeaders#67 (comment), the public API could do with some better coverage.

• https://github.com/nico3333fr/CSP-useful/blob/master/csp-wtf/not-explained.md#blocked-uri-inline
• https://github.com/nico3333fr/CSP-useful/blob/master/csp-wtf/not-explained.md#onclick-attribute-on-menuitem-element

This happens if you don't allow inline scripts--that is, <script> with no src attribute, but rather embedded JavaScript. Inline JavaScript has to be explicitly allowed via `'in

MDN says that style-src and connect-src support 'unsafe-inline', among others. As part of this work, we should:

1. Verify that MDN is correct
2. Add new directive values to this module

See the original issue, helmetjs/helmet#187.

It would be great to have instructions or link about Spring configuration.

Here is an instruction: https://docs.spring.io/spring-security/site/docs/4.2.x/reference/html/headers.html#headers-csp and mention that with Spring Boot it's possible to use security.headers.* properties.

Description

Straight from the docs, we can see this:

new HtmlWebpackPlugin({
  cspPlugin: {
    enabled: true,
    policy: {
      'base-uri': "'self'",
      'object-src': "'none'",
      'script-src': ["'unsafe-inline'", "'self'", "'unsafe-eval'"],
      'style-src': ["'unsafe-inline'", "'self'", "'unsafe-eval'"]
    },
    hashEnabled: {
      'script-src': true,