Ask developers about web security and you'll often hear about: authentication,

HTTPS, password hashing, or access control.

Ask about Content Security Policy (CSP), and suddenly the conversation becomes much quieter.

Which is strange.

Because CSP is one of the few browser-level defenses that can significantly reduce the impact of client-side attacks.

Yet many applications either don't use it at all or deploy it in a way that provides almost no protection.