CSP is a defence-in-depth control against cross-site scripting. Even if an attacker injects a script tag, the browser refuses to execute it unless its source is allowed by the policy.

Adding a third-party widget to a site with a strict CSP means adding that widget's origin to script-src, and its API origin to connect-src. A widget that also needs unsafe-inline or unsafe-eval is asking you to weaken your policy for everyone.

A well-behaved embedded script loads from one origin, calls one API origin, and injects no inline script — so the CSP change it requires is two entries.

Why it matters

A tool that forces you to loosen your CSP has increased your attack surface well beyond its own feature set.