Laravel Pixel Laravel Package

Product Decisions This Supports

• Security and compliance roadmap: Enables strict, nonce-based script-src CSP policies without 'unsafe-inline', supporting enterprise security reviews, SOC 2/PCI hardening efforts, and customer security questionnaires.
• Build vs. buy: The package now handles Laravel Vite CSP nonce propagation for rendered <script> tags, reducing the need for custom in-house patching or wrappers around script injection.
• Feature and integration decisions: Makes the package viable for apps that already enforce CSP through laravel-security-headers or custom middleware, including third-party analytics, widgets, and embed scripts.
• Release risk: The change appears additive and backward compatible; apps without a CSP nonce should see no behavior change.

When to Consider This Package

• Consider it when your Laravel app uses Vite’s CSP nonce and enforces a nonce-based script-src policy.
• It is a strong fit if the package renders <script> tags on your behalf and you want those tags to participate in the app’s CSP model automatically.
• Evaluate it when security teams require removal of 'unsafe-inline' from production CSP headers.
• Look elsewhere if your app does not use CSP, accepts 'unsafe-inline', or needs hash-based/SRI-based script policies rather than nonce-based policies.
• Confirm the package’s script rendering path is actually used in your integration; if it does not render scripts in your setup, this release provides no direct product value.

How to Pitch It (Stakeholders)

For executives: This is a low-risk security hardening release. It lets the application adopt stricter browser security policies without weakening them via 'unsafe-inline', which helps satisfy security reviews and reduces XSS exposure. No migration is implied.

For engineering: Version 3.1.0 propagates Laravel’s Vite CSP nonce onto every <script> the package renders when the app sets one. That means nonce-based script-src policies work out of the box, including with laravel-security-headers. Validate that your CSP middleware and nonce are active in the request lifecycle where the package renders scripts, then treat this as an additive upgrade rather than a breaking change.