CSP rules are a good defense-in-depth measure to most likely limit the reach of vulnerabilities. They&#x27;re not a cure-all that makes it so you don&#x27;t have to understand HTML&#x2F;text encoding.<p>It&#x27;s like what ASLR and stack canaries do for buffer overflow vulnerabilities in C&#x2F;C++. You still should try to avoid writing buffer overflow bugs, but if&#x2F;when they do happen, the protections mean that the issue will probably just be a denial-of-service issue rather than an issue that lets an attacker execute code on your systems.