Inline handlers on a page with a content policy
===============================================

Rule · bucket: judgment · severity: note · detector: none · since: v0.14.0
Section: Things to avoid
Group: Safety at the interface

Forbidden:
  `onclick="…"` in markup, a `<script>` with no nonce, on a site that sets a Content-Security-Policy

Instead:
  Bind behaviour in script (`E-33` asks for a real control anyway), and let the policy's nonce cover the one bootstrap the framework emits.

This is where a security decision made in configuration lands on whoever writes the markup: under a strict policy the inline handler simply does not run, and the page fails in the browser rather than in a check.