How do I add a Content Security Policy on Vercel?

The recommended way to add a dynamic CSP on Vercel with Next.js 16+ is through proxy.ts. Earlier Next.js versions use middleware.ts. You can also use the headers configuration in next.config.js for static CSP values or vercel.json for non-Next.js projects. A proper CSP should restrict script-src, style-src, img-src, and connect-src to only the domains your application needs. Using nonces for inline scripts is the most secure approach and requires request-time logic to generate a unique nonce per request. UNPWNED analyzes the externally returned CSP policy for supported unsafe-inline, unsafe-eval, and broad-wildcard signals; it does not inspect application code or nonce generation.