script-src strict-dynamic
The loader has a nonce so the browser trusts it. 'strict-dynamic' extends that trust to any script the loader injects — even though the injected script has no nonce of its own.
Response header
Content-Security-Policy: script-src 'nonce-M47Huf9BhblCRD6Avco7uA==' 'strict-dynamic'
Loader script in page source
<script nonce="M47Huf9BhblCRD6Avco7uA==">
var s = document.createElement('script');
s.src = '/lab-assets/scripts/sdk.js';
document.head.appendChild(s);
</script>
Loader script
Injected script (/lab-assets/scripts/sdk.js)