diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index fa7fd93d..7621fb6d 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -2,3 +2,7 @@
 **Vulnerability:** A `constant_time_eq` implementation iterated `max(a.len(), b.len())` times, exposing a DoS vector where a large input would cause excessive CPU usage.
 **Learning:** Attempts to "avoid leaking length" by checking all bytes can inadvertently introduce algorithmic complexity vulnerabilities. Standard practice is to check length first (leaking length but preventing DoS) and then compare in constant time.
 **Prevention:** Prefer `subtle` crate or idiomatic constant-time comparisons that explicitly handle length checks to bound execution time.
+## 2024-06-27 - XSS in Content Security Policy
+**Vulnerability:** The default production Content Security Policy (CSP) included 'unsafe-inline' and 'unsafe-eval' in script-src and style-src directives.
+**Learning:** Development CSP configurations frequently bleed into production defaults if strictness is not explicitly enforced. Permitting 'unsafe-inline' and 'unsafe-eval' severely undermines CSP protections against Cross-Site Scripting (XSS).
+**Prevention:** Ensure production CSP strictly defines directives without 'unsafe-*' keywords. Apply permissive CSP solely in explicitly configured development environments.
diff --git a/crates/app-http/src/middleware/security_headers.rs b/crates/app-http/src/middleware/security_headers.rs
index cd9a57da..0b2cc846 100644
--- a/crates/app-http/src/middleware/security_headers.rs
+++ b/crates/app-http/src/middleware/security_headers.rs
@@ -44,9 +44,9 @@ pub struct SecurityHeadersConfig {
 impl Default for SecurityHeadersConfig {
     fn default() -> Self {
         Self {
-            // Strict CSP for production, more permissive for development
+            // Strict CSP for production by default
             content_security_policy: Some(
-                "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none';".to_string(),
+                "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none';".to_string(),
             ),
             x_frame_options: "DENY".to_string(),
             x_content_type_options: "nosniff".to_string(),
diff --git a/crates/http-middleware/src/security_headers.rs b/crates/http-middleware/src/security_headers.rs
index fb55c73e..651a2240 100644
--- a/crates/http-middleware/src/security_headers.rs
+++ b/crates/http-middleware/src/security_headers.rs
@@ -44,9 +44,9 @@ pub struct SecurityHeadersConfig {
 impl Default for SecurityHeadersConfig {
     fn default() -> Self {
         Self {
-            // Strict CSP for production, more permissive for development
+            // Strict CSP for production by default
             content_security_policy: Some(
-                "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none';".to_string(),
+                "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none';".to_string(),
             ),
             x_frame_options: "DENY".to_string(),
             x_content_type_options: "nosniff".to_string(),