The CSP allows Cloudflare Web Analytics (browser check, WS-Q task 3): script-src https://static.cloudflareinsights.com loads the beacon Cloudflare injects at the edge, connect-src https://cloudflareinsights.com is where it reports. The network's privacy text already says Cloudflare may measure performance, and Live and Tools allow it; here the policy blocked it and every page view logged a CSP error.

ddiff --git a/server/app.js b/server/app.js
iindex a971c91..d6efbf6 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -85,13 +85,15 @@ function createApp(opts = {}) {
              directives: {
                  defaultSrc: ["'self'"],
                  // The OpenVibe Frame (theme-loader, navbar, footer) comes from the Network; the inline init is ours.
--                scriptSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network'],
++                // Cloudflare Web Analytics: Cloudflare injects its beacon at the edge and the privacy text says it may
++                // measure performance; script-src loads the beacon, connect-src is where it reports.
++                scriptSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://static.cloudflareinsights.com'],
                  styleSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://fonts.googleapis.com', 'https://cdnjs.cloudflare.com'],
                  fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com', 'https://cdnjs.cloudflare.com'],
                  // Media objects are served by openvibe.media (which may redirect to object storage).
                  imgSrc: ["'self'", 'data:', 'https:'],
                  mediaSrc: ["'self'", 'https:'],
--                connectSrc: ["'self'", 'https://openvibe.network'],
++                connectSrc: ["'self'", 'https://openvibe.network', 'https://cloudflareinsights.com'],
                  frameSrc: ["'self'", 'https://openvibe.network'],
                  frameAncestors: ["'self'"],
                  objectSrc: ["'none'"],