February 8, 2026HeaderTest Team
Next.js + Sanity CMS: CSP Gap and Image Proxy Risk
A lot of Next.js sites using Sanity CMS ship with no CSP at all. Worse, the _next/image endpoint can become an open image proxy for cdn.sanity.io. Here's what's happening and how to lock it down.
Read more