1. Why this talk, why now: Cross-Site Scripting has been in the Open Worldwide Application Security Project(OWASP) Top 10 for over a decade. It's not a new problem. But a lot of Django apps are still running without any Content Security Policy not because developers don't care, but because setting it up has always felt like extra work on top of everything else. Django 6.0 removes that excuse. Content Security Policy is now a built-in feature. No extra dependencies. No hunting through third-party docs. Just a settings block and a middleware line. 2. What we'll cover: --What Content Security Policy actually does: how the browser enforces it and what kind of attacks it stops (and what it doesn't) --Django 6.0's new middleware: getting protected in under 10 lines of settings --Report-only mode: auditing your app for violations before you touch production --Nonces: how Django generates them per-request, and why they're better than 'unsafe-inline' --Rolling it out safely: a phased approach that won't blow up your app on day one --The gotchas: Content Delivery Networks(CDNs), third-party embeds, Django Admin, and the traps most people fall into 3. Live demo: We'll trigger a real CSP violation, read the browser's error, update the policy, and watch the fix take effect. Everything runs on a real Django 6.0 project not slides with fake terminal output. 4. Who this is for: Any Django developer, at any level. You don't need a security background. If you've written a Django view, you'll follow every step of this talk. 5. What you'll leave with: A working settings template and enough understanding of Content Security Policy to know when something's wrong and how to fix it.