Changes of the module don't reflect in front-end

Are the errors being reported on all pages (e.g. while you're viewing the settings form with all options disabled, or only public pages)? Do you see a Content-Security-Policy or Content-Security-Policy in the response headers in the browser developer tools? Do you have a proxy service caching pages between the server and your browser?

The module tags its own cached info and any page responses with the settings key, so they should be automatically invalidated when you save the settings page. Private responses, such as for authenticated users, should always bypass any page caching and generate the header based on the latest settings (provided the cache backend understands cache tag invalidations).

Sorry I'm so stupid…
I had a chrome extension running showing a CSP report.
Problem solved.