From 4a00199c85725482abc0a7216f2e59a613c44294 Mon Sep 17 00:00:00 2001
From: Rui Covelo <rui.covelo@outsystems.com>
Date: Thu, 3 Jul 2025 17:01:02 +0100
Subject: [PATCH] Update configure-csp.md

---
 src/eap/security/configure-csp.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/eap/security/configure-csp.md b/src/eap/security/configure-csp.md
index 6d03f701..7d156a2e 100644
--- a/src/eap/security/configure-csp.md
+++ b/src/eap/security/configure-csp.md
@@ -144,9 +144,9 @@ OutSystems recommends default values to ensure the platform works as expected. I
 
 The **Required values** column indicates the values that ODC automatically applies to the directive for the applications to work correctly. These values can't be removed.
 
-* ``unsafe-inline``: The unsafe-inline directive allows the use of inline resources such as inline ``<script> ``and ``<style>`` elements, ``javascript: URLs``, and inline event handlers. Therefore, any user can inject a script attribute into your website and perform the cross-site scripting (XSS) attack.
+* ``unsafe-inline``: The unsafe-inline directive allows the use of inline resources such as inline ``<script> ``and ``<style>`` elements, ``javascript: URLs``, and inline event handlers that are currently used by the platform.
 
-* ``unsafe-eval``: The unsafe-eval directive allows the web pages to evaluate strings as code. This directive consists of the eval function, the function constructor, and some usages of the setTimeout and setInterval functions. This directive leads to reduced protection against certain types of DOM-based XSS attacks.
+* ``unsafe-eval``: The unsafe-eval directive allows the web pages to evaluate strings as code. This directive consists of the eval function, the function constructor, and some usages of the setTimeout and setInterval functions that are currently used by the platform.
 
 ## Operational and security considerations