"They use a minimum CSP policy in all pages in the app."
- What is in this minimum policy? Is this automatic? If it is, can the author override it? How does this work with resources on CDNs and other domains? Is there any reporting done where the author can debug? This will potentiallly block all add-ons, for good or bad - there are still open bugs on CSP.