Also covers the adapters' staticHeaders option (formerly experimentalStaticHeaders) for emitting CSP as HTTP headers instead of a meta tag, and the 7.1+ kind scoping to script-src-elem/-attr and style-src-elem/-attr. States the known limitations: CSP is inactive in dev mode (test with build + preview), incompatible with <ClientRouter /> view transitions, and unsupported for Shiki's inline styles. Does not cover general deployment adapter setup beyond the CSP header wiring (astro-deployment).

Astro Security

Agent Workflow (MANDATORY)

Before ANY implementation, spawn 3 agents in parallel, one Agent call each with a name:

1. fuse-ai-pilot:explore-codebase - Analyze existing security config, adapters, headers
2. fuse-ai-pilot:research-expert - Verify latest Astro 7 CSP docs via Context7/Exa
3. mcp__context7__query-docs - Check CSP compatibility with deployment adapter

After implementation, run fuse-ai-pilot:sniper for validation.