The grandparent task for CSP in core is T28508

The RFC for implementing CSP in core has a pretty clear set of steps: https://www.mediawiki.org/wiki/Requests_for_comment/Content-Security-Policy

That RFC leaves till the last step fully blocking 3rd party images and iframes, but the report-only CSP currently being served does report on those. So if they go to step 6 (actually enforcing CSP on the main wikis) without adding exceptions to img-src and child-src they'll break the RML form.

Thanks for looking into this @Ejegg. How does this impact our us and our projects?

Had a meeting with the security team today, where we determined that there will not be any changes coming from them in the next 6 months that will break RML for the banners. They've got a whole lot of other components to work through before they can make CSP enforcing. However, they would be happy if we had a plan to improve privacy next year for donors using that feature.

That's good to know, thanks @Ejegg!