The CSP allows Cloudflare Web Analytics (browser check, WS-Q task 3): script-src https://static.cloudflareinsights.com loads the beacon Cloudflare injects at the edge, connect-src https://cloudflareinsights.com is where it reports. The network's privacy text already says Cloudflare may measure performance, and Live and Tools allow it; here the policy blocked it and every page view logged a CSP error.

ddiff --git a/server/app.js b/server/app.js
iindex 76c0041..730bd4f 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -74,11 +74,13 @@ function createApp(opts = {}) {
              directives: {
                  defaultSrc: ["'self'"],
                  // The OpenVibe Frame (theme-loader, navbar, footer) comes from the Network; the inline init is ours.
--                scriptSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network'],
++                // Cloudflare Web Analytics: Cloudflare injects its beacon at the edge and the privacy text says it may
++                // measure performance; script-src loads the beacon, connect-src is where it reports.
++                scriptSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://static.cloudflareinsights.com'],
                  styleSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://fonts.googleapis.com', 'https://cdnjs.cloudflare.com'],
                  fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com', 'https://cdnjs.cloudflare.com'],
                  imgSrc: ["'self'", 'data:', 'https://openvibe.network', 'https://openvibe.media'],
--                connectSrc: ["'self'", 'https://openvibe.network'],
++                connectSrc: ["'self'", 'https://openvibe.network', 'https://cloudflareinsights.com'],
                  frameSrc: ["'self'", 'https://openvibe.network'],
                  frameAncestors: ["'none'"],
                  objectSrc: ["'none'"],