:thumbsup:

Does docs work with this? We don't have a frame-src and default does not include https: after this. Embedded docs iframe should fail.

We could add frame-src and connect-src statements when docs and ev are enabled on the config

This is the default and should be tweaked by the admins according to their configuration. Since we do not have neither EV nor docs on by default I think it's fine as is.

However, it may be good to make this explicit in the docs, would you like to open a PR to that end?

works for me. :thumbsup:

Thanks :)