Shipped current (excludes unsupported and deprecated) weblets are compliant with Content Security Policy with some exceptions (as noted in the weblet documentation). If you have your own weblets, you need to ensure they also comply with the specification.
