diff --git a/resources/views/app.blade.php b/resources/views/app.blade.php
index ae0bdbea..87fdcb3b 100644
--- a/resources/views/app.blade.php
+++ b/resources/views/app.blade.php
@@ -3,6 +3,9 @@
 <head>
     <meta charset="utf-8"/>
     <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0"/>
+    @if (app()->environment('production'))
+        <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' https://rsms.me/inter/inter.css 'unsafe-inline'; img-src 'self' https://eu.ui-avatars.com/ data:; font-src 'self' https://rsms.me/ ; base-uri 'self'; form-action 'self'; frame-src 'self'; object-src 'none';">
+    @endif
     <link rel="icon" href="/images/icon.png">
     <link rel="stylesheet" href="https://rsms.me/inter/inter.css">
     @vite('resources/js/app.js')
