“If this is— and this is a true story— one of the first ones I did had one page that had a WYSIWYG editor that needed unsafe-inline and unsafe-eval, but enabling that for the entire application was wrong because it didn't need that anywhere else.”

Transcript evidence from Neil Matatall — Content Security Policy.