Live preview does not udpate with Seckit module configured.

Excellent find, thanks!

We should have a test that reproduces this, to ensure XB indeed works on sites with Content-Security-Policy active.

Ideally, that test wouldn't require installing the seckit module, but we could make that work — see 📌 Page has Metatag integration Active for how we added a test for XB + metatag, without making XB depend on it.

I have created a simple component which has a Heading text

Is this an SDC? Is this the existing experience_builder:heading SDC?

I have created a component from scratch through XB. Attached screenshot about example.

wim leers → credited balintbrews → .

#3: Ah, that makes a ton more sense: it's a code component. I suspected it, but couldn't be certain based on the issue summary. Cool, then we'll be able to reproduce this easily.

I hear from @balintbrews that there's been chats about this problem space, and that @mglaman has additional detail to share, as well as @effulgentsia. Since Matt is further east than Alex, assigning to him first.

AFAICT this has been (largely?) solved elsewhere?

@balintbrews, can you give us an update? 😇🙏

📌 Do not inline script for code editor preview Active was our immediate response, but it didn't fix everything. E.g. we still use the blob URI scheme, which still may not be great when it comes to strict CSP configurations.

@attilatilman, what is the current config you're using?

Thanks!

This seems like a stable blocker? 😇

Or even 🌱 Milestone 1.0.0-beta1: Start creating non-throwaway sites Active .

Per discussion with @lauriii, this doesn't have to block beta1, but it would be good to resolve early in the beta phase.