The security of a Content-Security-Policy is measured in the number of browser extensions it breaks.