Hacker News Reader

Interesting, what version of Firefox is this? You can see in the CSP that 'self' is a defined keyword for both the script-src and style-src directives: https://report-uri.io/home/analyse/https%3A%2F%2Fsecurityhea...

44.0, but as it turns out, an update is available.

Did that fix it? Failing that, do you have any extensions or other things that might affect this?

Your latest change allowed me to whitelist azureedge.net in RequestPolicy. All of them say "A CSP report is being sent."