feat: add blog about CSPs

[iBotPeaches]

Changed title like 4 times, so open for other ideas.

[Copilot]

Pull request overview

Adds a new Docusaurus blog post describing a workflow for detecting and addressing Content Security Policy (CSP) violations locally in a Laravel application, and updates site syntax highlighting to better support the post’s NGINX configuration examples.

Changes:

• Added a new blog post: “CSPs & Laravel” (MDX) including NGINX and Vue/ReportingObserver examples.
• Enabled Prism highlighting for nginx code blocks in the Docusaurus theme config.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 5 comments.

File	Description
docusaurus.config.ts	Adds Prism nginx to additionalLanguages to support NGINX code highlighting in docs/blog content.
blog/2026/2026-08-03-csps-and-laravel/index.mdx	Introduces a new blog post covering CSP concepts and a local CSP-violation monitoring workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (3)

blog/2026/2026-08-03-csps-and-laravel/index.mdx:14

• The directive list here is presented as exhaustive for CSP Level 3, but it omits several widely used, non-experimental directives (e.g., base-uri, form-action, frame-ancestors, upgrade-insecure-requests, etc.). This makes the post factually misleading.

As of July 2026, the CSP Level 3 specification has the following non-experimental directives:

blog/2026/2026-08-03-csps-and-laravel/index.mdx:53

• report-to does not take a URL; it takes a reporting group name that must be defined via a Report-To / Reporting-Endpoints response header. Since this snippet uses a *_URL variable and doesn't show the companion header, readers may copy-paste a non-working policy.

add_header Content-Security-Policy "${CSP_DEFAULT_SRC}; ${CSP_FONT_SRC}; ${CSP_FRAME_SRC}; report-to ${SENTRY_CSP_URL};" always;

blog/2026/2026-08-03-csps-and-laravel/index.mdx:38

• The terminology in this paragraph is non-standard: CSP defines an enforced policy header (Content-Security-Policy) and a report-only policy header (Content-Security-Policy-Report-Only). Using consistent terms will make this easier to follow and search for.

CSP designed a method to help you in this journey with an enforce mode and report mode. As the names suggest enforce mode will enforce the CSP policy and violations will be blocked & reported. Report mode will not block violations, but still report them.