Contact (email obfuscation target)

Rendered at 2026-10-19T12:05:11.501Z. ← home

Addresses

CMS block

CMS-authored block. Its inline script is authorized by a hash, not the nonce.

Third-party scripts (parser-inserted, so the worker can stamp them)

One host on the shared allowlist and one that is not. Under an enforcing nonce policy the second must be refused — that is the proof the policy is actually live, independent of the email question.

collecting…