How We Implemented Content Security Policy (CSP) in Our Laravel App

Our pentest report had one line that stopped us cold: "Application does not implement Content-Security-Policy headers. XSS payloads executed without restriction." We had Sanctum, CSRF tokens, input validation — all the standard Laravel security checklist items. But we had no CSP. And without it, a s