That Next.js issue is 5 years old, here's a more recent discussion where we're exploring adding a CSP by default (https://github.com/vercel/next.js/issues/23993

That Next.js issue is 5 years old, here's a more recent discussion where we're exploring adding a CSP by default (https://github.com/vercel/next.js/issues/23993 https://github.com/vercel/next.js/issues/23993). We've also added documentation on adding HTTP response headers to improve security (https://nextjs.org/docs/advanced-features/security-headers https://nextjs.org/docs/advanced-features/security-headers).