i do the same for Content Security Policy: `default-src 'none'` by default, then add what i need when i need it.