The page loads Inter from fonts.googleapis.com. Everything else on the site is its own, so serve Inter from public/fonts (the variable woff2, latin subset), preload it, and drop the Google origins from the page and the content-security-policy in src/server.ts.
Done when the page makes no request outside its own origin and the forge (check the network panel), the text looks the same, and the CSP test in test/server.test.ts asserts no Google origin.
Try: open the preview with the network panel open and filter by domain.
The page loads Inter from fonts.googleapis.com. Everything else on the site is its own, so serve Inter from public/fonts (the variable woff2, latin subset), preload it, and drop the Google origins from the page and the content-security-policy in src/server.ts.
Done when the page makes no request outside its own origin and the forge (check the network panel), the text looks the same, and the CSP test in test/server.test.ts asserts no Google origin.
Try: open the preview with the network panel open and filter by domain.