Someone is attempting to deploy a commit to a Personal Account owned by @timlrx on Vercel.

@timlrx first needs to authorize it.

Ahh right, I forgot them, sorry 🙈
While we are at it, maybe we should also add the URLs for the other analytics scripts (plausible.io, scripts.simpleanalyticscdn.com and vitals.vercel-insights.com).

Ahh right, I forgot them, sorry 🙈 While we are at it, maybe we should also add the URLs for the other analytics scripts (plausible.io, scripts.simpleanalyticscdn.com and vitals.vercel-insights.com).

I have updated the whitelist, thank you for your contribution 🍻

I just figured out that we do not have to put vitals.vercel-insights.com in the CSP, as we do not load scripts from there but only send pings, which is already allowed by connect-src *;.
I thought that the CSP was blocking vitals.vercel-insights.com on my site, but it was actually my ad-blocker 🙄

I preference would be to only add giscus.app to the CSP so that it works for this demo. Users who clone the template would have to configure the CSP based on other integrations which they opted in for. Yes, it's a little more hassle this way but I think it's better than whitelisting every analytics or comment provider.

I preference would be to only add giscus.app to the CSP so that it works for this demo. Users who clone the template would have to configure the CSP based on other integrations which they opted in for. Yes, it's a little more hassle this way but I think it's better than whitelisting every analytics or comment provider.

I agree with you, although this will affect the user experience, because we are hard to dynamically generate CSP, so we agree to only add giscus.app

Yes, this was also discussed in the issue by Alexander. There's a bit of trade-off between having a better default security practice vs ease of setting up the template.

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/timlrx/tailwind-nextjs-starter-blog/Ebf2bNNZMAhv4KKxrfo9i9QMcehE
✅ Preview: https://tailwind-nextjs-starter-blog-git-fork-llovvoll-fi-1d62fe-timlrx.vercel.app