Laravel Amplitude Laravel Package

Product Decisions This Supports

• Security/compliance roadmap: Adds nonce-aware <script> rendering, making the package viable in apps enforcing strict script-src CSP without 'unsafe-inline'.
• Enterprise readiness: Reduces friction in security reviews for teams using Laravel Vite CSP nonces or laravel-security-headers.
• Build vs. buy: Strengthens the case for adopting the package rather than maintaining custom script-injection code just to satisfy CSP requirements.
• Feature rollout: Enables use in customer-facing or admin surfaces where inline scripts are restricted by policy.
• Use cases: Embedding package-rendered scripts/widgets in Laravel apps with nonce-based CSP, especially regulated or security-sensitive environments.

When to Consider This Package

Consider it when:

• Your Laravel app uses a CSP nonce, including Vite’s nonce integration or laravel-security-headers.
• The package renders <script> tags as part of its core behavior.
• You need to avoid 'unsafe-inline' in script-src.
• Security/compliance requirements are part of the adoption decision.

Look elsewhere or plan mitigation when:

• You need broader CSP compatibility beyond script nonces, such as style nonces or complex trust policies.
• The package’s script behavior cannot be adapted to your CSP model.
• You are not using nonce-based CSP and do not expect to.

How to Pitch It (Stakeholders)

For executives: This release improves security compatibility. The package can now work in Laravel applications that enforce strict Content Security Policy rules, reducing the need for custom workarounds or weaker security settings.

For engineering: Package-rendered scripts automatically carry Laravel’s Vite CSP nonce when configured. This supports nonce-based script-src policies without requiring 'unsafe-inline', lowering integration risk for security-conscious Laravel apps. It is a compatibility/security enhancement, not a breaking change.