fix: use non-eval source maps, script-src self

netlify.toml

@@ -8,4 +8,4 @@
   for = "/*"
   [headers.values]
     X-Frame-Options = "DENY"
-    Content-Security-Policy = "frame-src 'none';"
+    Content-Security-Policy = "script-src 'self'; frame-src 'none';"

packages/app/vercel.json

@@ -10,7 +10,7 @@
         },
         {
           "key": "Content-Security-Policy",
-          "value": "frame-src 'none';"
+          "value": "script-src 'self'; frame-src 'none';"
         }
       ]
     }

packages/app/webpack.config.js

@@ -53,7 +53,7 @@ const hmtlProdOpts = !isDevelopment
 
 const getSourceMap = () => {
   if (extEnv === 'web') {
-    return nodeEnv === 'production' ? 'eval' : 'cheap-module-source-map';
+    return 'cheap-module-source-map';
   }
   return 'none';
 };