fix: document unsafe-* CSP directives

[mitoperni]

Description

Document why each unsafe-* directive is needed in the Content Security Policy, adding inline comments with justification and references.

Type of Change

• New feature
• Bug fix
• Refactoring
• Documentation
• Styling

Changes Made

• Added comment explaining unsafe-eval in script-src: required by Mapbox GL JS for new Function() style expression compilation, with link to upstream issue
• Added comment explaining unsafe-inline in script-src: required by Next.js hydration bootstrap scripts and JSON-LD with dangerouslySetInnerHTML
• Added comment explaining unsafe-inline in style-src: required by Mapbox GL JS for inline styles on markers, popups, and controls

Screenshots (if applicable)

N/A - comments only, no functional changes.

Checklist

• Code follows project style guidelines
• Self-review completed
• No TypeScript errors
• Tests added/updated
• All CI checks pass
• Tested on different screen sizes
• Loading states implemented
• Error handling in place

Related Issues

N/A

---

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cyclemap	Ready	Preview, Comment	Feb 9, 2026 5:52pm

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.