Content Security Policy does not fix unsafe rendering. But it gives the browser a rule set it can enforce when unsafe HTML reaches the page. In this first post, we use a reflected XSS example to show what CSP blocks, what it does not block, and why CSP should be treated as a frontend design constraint — not just a header added at the end.