discourse/lib/content_security_policy
..
builder.rb
default.rb
extension.rb
middleware.rb