title: how to disable Content Security Policy and stay secure?
body: <p>i want to disable the CSP - <code>app.use(helmet.contentSecurityPolicy())</code> because it blocks any inline-scripts. the <strong>hash</strong> and <strong>nonce</strong> solutions (<a href="https://content-security-policy.com/examples/allow-inline-script/" rel="nofollow noreferrer">https://content-security-policy.com/examples/allow-inline-script/</a>) are too much overkill for my app.
  is the <a href="https://www.npmjs.com/package/xss-clean" rel="nofollow noreferrer"><code>xss-clean</code> package</a> or others solutions are enough to get a regular-moderate security?</p>
  <p>thanks :)</p>