## What this fixes
A site with a strict Content Security Policy (no 'unsafe-eval') loads the Braze web SDK through Google Tag Manager, one of Braze's recommended methods. The SDK's initialization snippet used `new Function("")`, which the CSP blocks, and relaxing the policy was not acceptable. Nonces cannot be used because the script is injected via GTM.
## The fix
Braze removed the `eval`-based initialization snippet from the npm package in v3.3.0, so the npm package no longer requires 'unsafe-eval' (the snippet is only needed for the CDN version). Fix: use the npm package `@braze/web-sdk` at v3.3.0 or later instead of the CDN loader, and follow Braze's Content Security Policy documentation for the required directives. Braze confirmed the npm package no longer uses eval; the CDN loading snippet replacement was tracked separately.
Source: https://github.com/braze-inc/braze-web-sdk/issues/53
## Why it happens
The thread above nails the cause, so the fix addresses that directly rather than symptoms. Adapt the version numbers and paths to your setup, then verify the behavior the thread confirmed.
## Source
https://github.com/braze-inc/braze-web-sdk/issues/53