Laravel Umami Laravel Package

Product Decisions This Supports

• Security/compliance roadmap: v3.1.0 adds CSP nonce propagation to every <script> rendered by the package when Laravel’s Vite nonce is set. This supports nonce-based script-src policies without requiring 'unsafe-inline', making the package viable for stricter security baselines and regulated or enterprise customer environments.
• Build vs. buy: Reduces the need to build custom script-rendering wrappers solely to inject CSP nonces. Teams can adopt the package instead of maintaining one-off nonce plumbing around embedded scripts, analytics, widgets, or other package-rendered script tags.
• Enterprise readiness and procurement: Helps clear security reviews that reject inline scripts or require CSP Level 2/3 nonce support. This can unblock sales cycles in security-sensitive segments.
• Feature prioritization: Treat CSP compatibility as a first-class requirement for any package that emits scripts. Validate future releases against nonce-based CSP, not just functional rendering.
• Use cases: Laravel apps using laravel-security-headers, Vite, and strict CSP; embedded third-party widgets; analytics/tag management; schema or script snippets; any package-managed <script> output in environments where 'unsafe-inline' is disallowed.

When to Consider This Package

Consider adoption when:

• The application uses Laravel Vite and sets a CSP nonce, especially via laravel-security-headers or similar middleware.
• Security policy requires nonce-based script-src and disallows 'unsafe-inline'.
• The product emits package-managed <script> tags and you want CSP compliance without custom wrappers or post-processing.
• You are standardizing script rendering across embedded widgets, analytics, or other third-party snippets.
• Security review or enterprise procurement requires demonstrable CSP support.

Look elsewhere or defer when:

• The application has no CSP or intentionally relies on 'unsafe-inline'.
• Scripts are rendered outside this package’s control, so the nonce feature does not cover the actual risk surface.
• You need broader consent-management, tag governance, or script sandboxing beyond nonce injection.
• The platform is not Laravel/PHP or does not use Vite-managed nonces.
• You require guarantees beyond script nonce propagation, such as automated CSP reporting, hash-based policies, or full third-party script inventory.

How to Pitch It (Stakeholders)

Executives: v3.1.0 makes the package compatible with strict nonce-based CSP, removing a common blocker in security reviews and enterprise deals. It reduces custom security work and helps the product meet customer security requirements without weakening CSP with 'unsafe-inline'.

Engineering: The package now automatically applies Laravel’s Vite CSP nonce to every <script> it renders when the app sets one. This integrates cleanly with existing Laravel security-header middleware and eliminates bespoke nonce-injection code around package-rendered scripts. No breaking changes are indicated; validate in apps with strict script-src policies and confirm coverage for all script-emitting paths.