Laravel Plausible Laravel Package

Product Decisions This Supports

• Unblocks strict-CSP customers. Apps enforcing nonce-based script-src can now render this package's scripts without adding 'unsafe-inline' or a host allowlist — the two workarounds security teams most often reject. This is a sales-cycle unblocker (enterprise, regulated, public sector), not a nice-to-have.
• Build vs buy tilts toward buy. Teams that previously faced a "fork it or hand-roll the script tag" tax now have no reason to maintain a local patch. Retire internal forks and blade overrides that existed only to inject a nonce.
• Roadmap / positioning. Supports a "CSP-safe by default" claim for any widget or embed surface, and fits naturally into an enterprise/security tier rather than bespoke professional services work.
• Composability. Because it reuses Laravel's Vite nonce rather than minting its own, it co-exists with laravel-security-headers and other nonce-aware tooling instead of competing with it — one nonce source of truth.
• Audit and questionnaire readiness. Directly answers the "do you use unsafe-inline?" question in SOC 2 / ISO 27001 reviews, pen-test remediations, and customer security questionnaires.

When to Consider This Package

Adopt or upgrade when:

• Your app sets a Content-Security-Policy with nonces, or has one on the roadmap.
• You run laravel-security-headers (or equivalent) — the package now inherits the same nonce automatically, with no configuration when the app already sets one.
• You're carrying a local fork or manual Blade override solely to add nonce="{{ Vite::cspNonce() }}". That maintenance cost is now avoidable.
• You're mid-way through a security review, audit, or enterprise procurement cycle with a CSP requirement on the checklist.
• You're on the 3.x line: this release is additive and non-breaking, so upgrading carries minimal risk.

Look elsewhere or deprioritize when:

• Your CSP is host-allowlist or hash-based rather than nonce-based — there is nothing to gain here.
• You have no CSP and no near-term plan for one; the change is inert (harmless, but not a reason to prioritize the upgrade).
• Your script injection happens outside this package (raw Blade, third-party SDKs, tag managers): those still need their own nonce handling, and this release does not cover them.
• You require the package to manage nonce generation itself — it consumes the app's nonce rather than providing one.

How to Pitch It (Stakeholders)

Executives: "This removes a recurring security objection in enterprise deals. Customers can enforce the strictest script policy — the one their security teams mandate — without weakening it for our widget. The upgrade is additive and non-breaking: no migration budget, no customer-facing behavior change for apps without a CSP."

Engineering: "Every <script> the package renders now carries the same Vite CSP nonce the app already exposes, so it slots into a nonce-based script-src alongside laravel-security-headers with zero configuration. Upgrading lets us delete the local patch and drop the 'unsafe-inline' exception from our policy. Verification path: confirm the nonce is present in the rendered tag, run CSP in report-only in staging, and check for violations before flipping to enforce."

Risk framing: No breaking changes, no new dependency, no runtime behavior change for apps without a CSP. The only meaningful verification step is a staging pass with CSP reporting enabled.