Is this a hackmd.io issue?

• Yes, the bug happens on https://hackmd.io

What's the problem

Current behaviour

Opening the HackMD sign-in page triggers 17 Content Security Policy (CSP) errors in the browser console:

1. script-src directive blocks inline script execution and scripts from multiple external domains (YouTube, Google, Stripe, Sentry, Plausible, Tally, etc.)
2. font-src directive blocks font loading from several URLs (16 occurrences)

The CSP header appears to be missing required domains in its whitelist, and lacks proper nonce or 'unsafe-inline' configuration for inline scripts.

Screenshot:

Steps to reproduce:

1. Go to https://hackmd.io/login