Hacker News Reader

How does this compare to HTMX (security wise)?

Same, you control your signals and fragments. So you are responsible for proper escaping and thoughtful design.

You can disable all use of eval with htmx. The tradeoff is one has to write a bit more JavaScript.

I have thoughts about a fully compliant CSP middleware, problem is it's per language so I'd probably only make for Go (maybe PHP & TS)

Hashes or nonces?

Hashed script content

Thank you for doing this. Is it possible to follow the work somewhere?

Not right now. CSP in a Datastar context is mostly a red herring. If an enterprise wants it to check a box then please reach out.

I don't represent an enterprise; just a dev. It would make it easier to sell the idea of Datastar to clients if it was compatible with strict CSP.