From efe5d4c8de765d4ccd92176b8892465464400bb6 Mon Sep 17 00:00:00 2001
From: Fabricio Giglio <58532944+gigliof@users.noreply.github.com>
Date: Fri, 15 May 2026 13:10:03 +0200
Subject: [PATCH] Allow smplr 0.20's new CDN host (smpldsnds.github.io) in CSP

---
 frontend/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/index.html b/frontend/index.html
index 42305c0..5d4823a 100644
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -6,7 +6,7 @@
     <!-- T4-1: Content Security Policy: restrict script/style/connect sources.
          'unsafe-inline' for script-src is needed for the error overlay below;
          tighten by moving it to a separate .js file if desired. -->
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:; media-src 'self' blob:; connect-src 'self' https://gleitz.github.io https://danigb.github.io https://goldst.dev; worker-src 'self' blob:; object-src 'none'; base-uri 'self'" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:; media-src 'self' blob:; connect-src 'self' https://gleitz.github.io https://danigb.github.io https://smpldsnds.github.io https://goldst.dev; worker-src 'self' blob:; object-src 'none'; base-uri 'self'" />
     <title>Bach to Basics</title>
     <meta name="description" content="Browser-based piano practice tool. Import MIDI, MusicXML, or PDF sheet music and learn pieces with falling notes, interactive piano, A/B loop, speed trainer, and wait mode." />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />