PROTECTED CAPABILITY — S1 CSP nonce
This page is the after state. The capability Worker added a Content-Security-Policy header and fresh nonce attributes to every eligible script.
The document body is otherwise the origin fixture; compare the response headers and View Source for the protection changes.
Script fixtures appear before the noscript region, inside nested/malformed noscript blocks, and after the noscript region.