Alex Bishop

Accessible autocomplete requires style-src 'unsafe-inline' and 'unsafe-eval' to work on pages protected by Content Security Policy (CSP)

6

The accessible autocomplete does not seem to play very nicely with [Content Security Policy (CSP)](https://www.w3.org/TR/CSP2/), specifically the [`style-src`](https://www.w3.org/TR/CSP2/#style_src) directive: 1. On iOS browsers, it sets `style` attributes on elements, which...

Cannot redirect from /.well-known/security.txt

11

It appears to not be possible to make `/.well-known/security.txt` redirect to https://vdp.cabinetoffice.gov.uk/.well-known/security.txt in line with https://gds-way.cloudapps.digital/standards/vulnerability-disclosure.html. Configuring a redirect in either the global configuration file or the `config.rb` file as...

[DO NOT MERGE] PP-4822 Add text explaining $reference in email custom paragraph

2

Add some text to the page where the custom paragraph for email notification is configured, explaining that “$reference” will be replaced by the actual payment reference.