Update from code changes: document enforced default CSP

[mintlify]

Summary

Hosted documentation sites now enforce a default Content Security Policy. It allows any HTTPS origin but blocks HTTP resources, blob:/data: scripts, plugin objects, and cross-origin workers. Custom scripts or integrations that depend on those patterns stop working. This PR documents the enforced policy and what it blocks.

Triggered by https://github.com/mintlify/mint/pull/11819

Changes

• deploy/csp-configuration.mdx: added a "Default CSP" section with the full enforced policy, the resources browsers now block, and how to fix affected scripts.
• Updated the intro to say Mintlify enforces the default CSP, and added keywords.
• Mirrored the changes in es/, fr/, and zh/.
• Rewrote the passive "are blocked" bullets in active voice.

Notes for reviewers

• The PR says self-hosted deployments and customers with a bespoke CSP keep their existing policy. The page doesn't mention these exceptions. Add them if you want.

---

Note

Low Risk
Documentation-only updates with no runtime or configuration code changes.

Overview
Documents that Mintlify now enforces a default CSP on every hosted documentation site, replacing wording that implied a passive default policy.

Adds a Default CSP section (English plus es, fr, and zh mirrors) with the full Content-Security-Policy header value, notes on frame-ancestors / form-action, and explicit guidance on what browsers block under that policy: plain HTTP assets, blob:/data: scripts, plugin embeds, and cross-origin workers. The intro and frontmatter keywords are updated accordingly, and blocked-resource bullets use active voice. Localized pages wrap the new heading in <div id="default-csp"> for anchor stability.

^{Reviewed by Cursor Bugbot for commit 918f693. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
mintlify	🟢 Ready	View Preview	Sep 24, 2026, 3:56 PM