Security, CSP and SBOMs

Content-Security-Policy

A client-rendered app needs no 'unsafe-inline' and no 'unsafe-eval'. CI renders every element in Chromium under this policy and fails on any violation:

Content-Security-Policy:
  default-src 'self';
  script-src 'self';
  style-src 'self';
  img-src 'self' data:;
  require-trusted-types-for 'script';
  trusted-types lit-html

Component styles are constructable stylesheets, which a style-src doesn't block. Inline styles that change at runtime (a progress bar's width, a tooltip's position) are set through the CSSOM with cssProps from @lit-material/core, never as a style attribute.

Trusted Types

Components never assign HTML strings to the DOM themselves; Lit's own lit-html policy covers its templates, including icons registered with registerIcons (whose SVG strings are yours, so register only markup you trust). Allow lit-html in trusted-types. Site-kit's search box uses a policy named lit-material-site-kit; list it too if you use it.

Server-rendered pages

Server rendering writes each element's styles as a <style> inside its declarative shadow root, and runtime inline styles as style attributes, so the first paint can show them before any script runs. A server-rendered page therefore needs inline styles allowed (style-src 'self' 'unsafe-inline'); scripts can stay strict. Inline styles can't run code. The color-scheme boot script is inline: allow it by hash (script-src 'sha256-…', computed from colorSchemeBootScript()'s output) or serve it as a file.

SBOMs and provenance

Every package ships a CycloneDX SBOM of its runtime dependency tree at dist/sbom.cdx.json inside the npm tarball, generated from the lockfile when it's released; it includes the other lit-material packages it depends on. Packages are published from GitHub Actions with npm provenance, so npm audit signatures verifies each one was built from this repository's source.

npm audit signatures
cat node_modules/@lit-material/button/dist/sbom.cdx.json