Content security policy

does anyone know what the CSP must be to get a new Powerup to actually work… seems that trial-and-error (mostly error) is the official plan